OpenSSL CVE-2014-3569 Vulnerability

Description

Severity: LowWhen openssl is built with the no-ssl3 option and a SSL v3 ClientHello isreceived the ssl method would be set to NULL which could later result ina NULL pointer dereference.This issue affects all current OpenSSL versions: 1.0.1, 1.0.0 and 0.9.8.OpenSSL 1.0.1 users should upgrade to 1.0.1k.OpenSSL 1.0.0 users should upgrade to 1.0.0p.OpenSSL 0.9.8 users should upgrade to 0.9.8zd.This issue was reported to OpenSSL on 17th October 2014 by Frank Schmirler. Thefix was developed by Kurt Roeckx.

Affected Applications

OpenSSL

CVE References

Other References