CVE-2014-3569: Null Pointer Dereference
The ssl23getclienthello function in s23srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling. NOTE: this issue became relevant after the CVE-2014-3568 fix.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3569?
CVE-2014-3569 has a severity rating of high due to its potential to cause denial of service.
How do I fix CVE-2014-3569?
To fix CVE-2014-3569, upgrade to a version of OpenSSL that is not affected, such as 1.1.1w-0+deb11u1 or later.
What versions of OpenSSL are affected by CVE-2014-3569?
CVE-2014-3569 affects OpenSSL versions 0.9.8zc, 1.0.0o, and 1.0.1j.
What type of attack does CVE-2014-3569 enable?
CVE-2014-3569 enables remote attackers to conduct denial of service attacks through unexpected handshake attempts.
Is CVE-2014-3569 a buffer overflow vulnerability?
No, CVE-2014-3569 is not a buffer overflow vulnerability; it involves a NULL pointer dereference leading to daemon crash.