CVE-2015-1791: Race Condition
Published Jun 2, 2015
·Updated
Race condition in the ssl3getnewsessionticket function in ssl/s3clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier.
Affected Software
58 affected componentsFixes available
ubuntu/openssl<1.0.2
1.0.2
ubuntu/openssl<1.0.2
1.0.2
ubuntu/openssl<1.0.2
1.0.2
ubuntu/openssl<1.0.2
1.0.2
ubuntu/openssl<1.0.1-4ubuntu5.31
1.0.1-4ubuntu5.31
ubuntu/openssl<1.0.1
1.0.1
ubuntu/openssl<1.0.1
1.0.1
ubuntu/openssl<1.0.1
1.0.1
ubuntu/openssl<1.0.2
1.0.2
ubuntu/openssl<1.0.2
1.0.2
ubuntu/openssl<1.0.2
1.0.2
ubuntu/openssl<1.0.2
1.0.2
debian/openssl
1.1.1w-0+deb11u11.1.1n-0+deb11u53.0.14-1~deb12u13.0.14-1~deb12u23.3.2-1
OpenSSL OpenSSL<=0.9.8zf
OpenSSL OpenSSL=1.0.0
OpenSSL OpenSSL=1.0.0-beta1
OpenSSL OpenSSL=1.0.0-beta2
OpenSSL OpenSSL=1.0.0-beta3
OpenSSL OpenSSL=1.0.0-beta4
OpenSSL OpenSSL=1.0.0-beta5
OpenSSL OpenSSL=1.0.0a
OpenSSL OpenSSL=1.0.0b
OpenSSL OpenSSL=1.0.0c
OpenSSL OpenSSL=1.0.0d
OpenSSL OpenSSL=1.0.0e
OpenSSL OpenSSL=1.0.0f
OpenSSL OpenSSL=1.0.0g
OpenSSL OpenSSL=1.0.0h
OpenSSL OpenSSL=1.0.0i
OpenSSL OpenSSL=1.0.0j
OpenSSL OpenSSL=1.0.0k
OpenSSL OpenSSL=1.0.0l
OpenSSL OpenSSL=1.0.0m
OpenSSL OpenSSL=1.0.0n
OpenSSL OpenSSL=1.0.0o
OpenSSL OpenSSL=1.0.0p
OpenSSL OpenSSL=1.0.0q
OpenSSL OpenSSL=1.0.0r
OpenSSL OpenSSL=1.0.1
OpenSSL OpenSSL=1.0.1-beta1
OpenSSL OpenSSL=1.0.1-beta2
OpenSSL OpenSSL=1.0.1-beta3
OpenSSL OpenSSL=1.0.1a
OpenSSL OpenSSL=1.0.1b
OpenSSL OpenSSL=1.0.1c
OpenSSL OpenSSL=1.0.1d
OpenSSL OpenSSL=1.0.1e
OpenSSL OpenSSL=1.0.1f
OpenSSL OpenSSL=1.0.1g
OpenSSL OpenSSL=1.0.1h
OpenSSL OpenSSL=1.0.1i
OpenSSL OpenSSL=1.0.1j
OpenSSL OpenSSL=1.0.1k
OpenSSL OpenSSL=1.0.1l
OpenSSL OpenSSL=1.0.1m
OpenSSL OpenSSL=1.0.2
OpenSSL OpenSSL=1.0.2-beta1
OpenSSL OpenSSL=1.0.2a
Remediation
Event History
Jun 2, 2015
CVE Published
via Ubuntu·12:00 AM
Jun 12, 2015
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Jan 11, 2024
Data Sourced
via Launchpad·10:09 PM
Description