OpenSSL CVE-2015-1787 Input Validation Bypass Vulnerability

Description

Severity: ModerateIf client auth is used then a server can seg fault in the event of a DHEciphersuite being selected and a zero length ClientKeyExchange message beingsent by the client. This could be exploited in a DoS attack.This issue affects OpenSSL version: 1.0.2OpenSSL 1.0.2 users should upgrade to 1.0.2a.This issue was discovered and the fix was developed by Matt Caswell of theOpenSSL development team.

Affected Applications

OpenSSL

CVE References

Other References