CVE-2015-0287: Medium severity openssl vulnerability
Reusing a structure in ASN.1 parsing may allow an attacker to cause memory corruption via an invalid write. Such reuse is and has been strongly discouraged and is believed to be rare.
Applications that parse structures containing CHOICE or ANY DEFINED BY components may be affected. Certificate parsing (d2iX509 and related functions) are however not affected. OpenSSL clients and servers are not affected.
This issue affects OpenSSL versions: 1.0.2, 1.0.1, 1.0.0, and 0.9.8. This issue is fixed in versions: 1.0.2a, 1.0.1m, 1.0.0r, and 0.9.8zf.
Acknowledgements:
Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges Emilia Käsper as the original reporter.
Other sources
The ASN1itemexd2i function in crypto/asn1/tasndec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow attackers to cause a denial of service (invalid write operation and memory corruption) by leveraging an application that relies on ASN.1 structure reuse.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0287?
CVE-2015-0287 is categorized as a high severity vulnerability due to its potential for memory corruption exploits.
How do I fix CVE-2015-0287?
To fix CVE-2015-0287, update your OpenSSL version to 1.0.2 or 1.0.1 or any later version that resolves this issue.
What versions of OpenSSL are affected by CVE-2015-0287?
CVE-2015-0287 affects OpenSSL versions prior to 1.0.2 and includes all versions of 1.0.1 and earlier.
What kind of attacks can exploit CVE-2015-0287?
CVE-2015-0287 can lead to memory corruption, which could potentially allow an attacker to execute arbitrary code.
Is CVE-2015-0287 likely to be exploited in the wild?
While CVE-2015-0287 has the potential for exploitation, it is believed to be rare due to the specific conditions required.