CVE-2024-5535: SSL_select_next_proto buffer overread
Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer.
Other sources
OpenSSL: CVE-2024-5535 SSLselectnextproto buffer overread
— Microsoft
We are republishing this OpenSSL CVE to document that the latest version Microsoft Defender for Endpoint has been updated to protect against this OpenSSL library vulnerability.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/opensslto a version that resolves this vulnerability.Fixed in 1.1.1w-0+deb11u8Fixed in 3.0.20-1~deb12u2Fixed in 3.5.6-1~deb13u2Fixed in 3.5.7-1~deb13u2Fixed in 3.6.3-1Fixed in 3.6.4-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-5535?
CVE-2024-5535 is classified as a moderate severity vulnerability due to its potential impact on applications using OpenSSL.
How do I fix CVE-2024-5535?
To fix CVE-2024-5535, update your OpenSSL to version 3.3.2-1 or later if you are using an affected distribution.
What software is affected by CVE-2024-5535?
CVE-2024-5535 affects various versions of OpenSSL as implemented in products like Microsoft Azure Linux and Defender for Endpoint.
Does Microsoft Defender protect against CVE-2024-5535?
Yes, the latest version of Microsoft Defender for Endpoint has been updated to protect against CVE-2024-5535.
What is the OpenSSL API function related to CVE-2024-5535?
CVE-2024-5535 is related to the OpenSSL API function SSL_select_next_proto when called with an empty supported client list.