CVE-2015-1791: Race Condition

Published Jun 2, 2015

Updated

Race condition in the ssl3getnewsessionticket function in ssl/s3clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.

Affected Software

58 affected componentsFixes available

ubuntu/openssl<1.0.2

1.0.2

ubuntu/openssl<1.0.2

1.0.2

ubuntu/openssl<1.0.2

1.0.2

ubuntu/openssl<1.0.2

1.0.2

ubuntu/openssl<1.0.1-4ubuntu5.31

1.0.1-4ubuntu5.31

ubuntu/openssl<1.0.1

1.0.1

ubuntu/openssl<1.0.1

1.0.1

ubuntu/openssl<1.0.1

1.0.1

ubuntu/openssl<1.0.2

1.0.2

ubuntu/openssl<1.0.2

1.0.2

ubuntu/openssl<1.0.2

1.0.2

ubuntu/openssl<1.0.2

1.0.2

debian/openssl

1.1.1w-0+deb11u11.1.1n-0+deb11u53.0.14-1~deb12u13.0.14-1~deb12u23.3.2-1

OpenSSL OpenSSL<=0.9.8zf

OpenSSL OpenSSL=1.0.0

OpenSSL OpenSSL=1.0.0-beta1

OpenSSL OpenSSL=1.0.0-beta2

OpenSSL OpenSSL=1.0.0-beta3

OpenSSL OpenSSL=1.0.0-beta4

OpenSSL OpenSSL=1.0.0-beta5

OpenSSL OpenSSL=1.0.0a

OpenSSL OpenSSL=1.0.0b

OpenSSL OpenSSL=1.0.0c

OpenSSL OpenSSL=1.0.0d

OpenSSL OpenSSL=1.0.0e

OpenSSL OpenSSL=1.0.0f

OpenSSL OpenSSL=1.0.0g

OpenSSL OpenSSL=1.0.0h

OpenSSL OpenSSL=1.0.0i

OpenSSL OpenSSL=1.0.0j

OpenSSL OpenSSL=1.0.0k

OpenSSL OpenSSL=1.0.0l

OpenSSL OpenSSL=1.0.0m

OpenSSL OpenSSL=1.0.0n

OpenSSL OpenSSL=1.0.0o

OpenSSL OpenSSL=1.0.0p

OpenSSL OpenSSL=1.0.0q

OpenSSL OpenSSL=1.0.0r

OpenSSL OpenSSL=1.0.1

OpenSSL OpenSSL=1.0.1-beta1

OpenSSL OpenSSL=1.0.1-beta2

OpenSSL OpenSSL=1.0.1-beta3

OpenSSL OpenSSL=1.0.1a

OpenSSL OpenSSL=1.0.1b

OpenSSL OpenSSL=1.0.1c

OpenSSL OpenSSL=1.0.1d

OpenSSL OpenSSL=1.0.1e

OpenSSL OpenSSL=1.0.1f

OpenSSL OpenSSL=1.0.1g

OpenSSL OpenSSL=1.0.1h

OpenSSL OpenSSL=1.0.1i

OpenSSL OpenSSL=1.0.1j

OpenSSL OpenSSL=1.0.1k

OpenSSL OpenSSL=1.0.1l

OpenSSL OpenSSL=1.0.1m

OpenSSL OpenSSL=1.0.2

OpenSSL OpenSSL=1.0.2-beta1

OpenSSL OpenSSL=1.0.2a

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.0.2
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.0.1-4ubuntu5.31
Upgrade
Upgrade ubuntu/openssl to a version that resolves this vulnerability.
Fixed in 1.0.1
Upgrade
Upgrade debian/openssl to a version that resolves this vulnerability.
Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1n-0+deb11u5Fixed in 3.0.14-1~deb12u1Fixed in 3.0.14-1~deb12u2Fixed in 3.3.2-1

Event History

Jun 2, 2015

CVE Published

via Ubuntu·12:00 AM

Jun 12, 2015

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Parent advisories

This vulnerability appears in the following advisories.

USN-2639-1

CVE-2015-1791: Race Condition

Affected Software

Remediation

Event History

Parent advisories

Company

Resources

Contact