REDHAT-BUG-2164499: Medium severity OpenSSL EVP_PKEY_public_check() vulnerability
An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVPPKEYpubliccheck() function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2164499?
The severity of REDHAT-BUG-2164499 is medium with a risk rating of 4.
What is the primary impact of REDHAT-BUG-2164499?
The primary impact of REDHAT-BUG-2164499 is that it can lead to an application crash due to an invalid pointer dereference.
How can REDHAT-BUG-2164499 be triggered?
REDHAT-BUG-2164499 can be triggered when an application calls the EVP_PKEY_public_check() function with a malformed DSA public key.
What software is affected by REDHAT-BUG-2164499?
The software affected by REDHAT-BUG-2164499 is OpenSSL, specifically the EVP_PKEY_public_check() function.
How do I mitigate REDHAT-BUG-2164499?
To mitigate REDHAT-BUG-2164499, avoid using untrusted public keys for checking with the EVP_PKEY_public_check() function.