CVE-2014-8275

Published: Jan 9, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Affected (26)

Products: Openssl: Openssl

Openssl

1 product

Openssl

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Up to 0.9.8zc
Openssl Openssl	Version 1.0.0a
Openssl Openssl	Version 1.0.0b
Openssl Openssl	Version 1.0.0c
Openssl Openssl	Version 1.0.0d
Openssl Openssl	Version 1.0.0e
Openssl Openssl	Version 1.0.0f
Openssl Openssl	Version 1.0.0g
Openssl Openssl	Version 1.0.0h
Openssl Openssl	Version 1.0.0i
Openssl Openssl	Version 1.0.0j
Openssl Openssl	Version 1.0.0k
Openssl Openssl	Version 1.0.0l
Openssl Openssl	Version 1.0.0m
Openssl Openssl	Version 1.0.0n
Openssl Openssl	Version 1.0.0o
Openssl Openssl	Version 1.0.1a
Openssl Openssl	Version 1.0.1b
Openssl Openssl	Version 1.0.1c
Openssl Openssl	Version 1.0.1d
Openssl Openssl	Version 1.0.1e
Openssl Openssl	Version 1.0.1f
Openssl Openssl	Version 1.0.1g
Openssl Openssl	Version 1.0.1h
Openssl Openssl	Version 1.0.1i
Openssl Openssl	Version 1.0.1j

Related CWEs

CWE-310

References (80)

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679

Source: cret@cert.org

http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html

Source: cret@cert.org

http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148363.html

Source: cret@cert.org

http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00021.html

Source: cret@cert.org

http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html

Source: cret@cert.org

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html

Source: cret@cert.org

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00037.html

Source: cret@cert.org

http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142496179803395&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142496289803847&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142720981827617&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142721102728110&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=142895206924048&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=143748090628601&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=144050155601375&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=144050205101530&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=144050254401665&w=2

Source: cret@cert.org

http://marc.info/?l=bugtraq&m=144050297101809&w=2

Source: cret@cert.org

http://rhn.redhat.com/errata/RHSA-2015-0066.html

Source: cret@cert.org

http://rhn.redhat.com/errata/RHSA-2015-0800.html

Source: cret@cert.org

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150310-ssl

Source: cret@cert.org

http://www.debian.org/security/2015/dsa-3125

Source: cret@cert.org

http://www.mandriva.com/security/advisories?name=MDVSA-2015:019

Source: cret@cert.org

http://www.mandriva.com/security/advisories?name=MDVSA-2015:062

Source: cret@cert.org

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: cret@cert.org

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: cret@cert.org

http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html

Source: cret@cert.org

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Source: cret@cert.org

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: cret@cert.org

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Source: cret@cert.org

http://www.securityfocus.com/bid/71935

Source: cret@cert.org

http://www.securitytracker.com/id/1033378

Source: cret@cert.org

https://bto.bluecoat.com/security-advisory/sa88

Source: cret@cert.org

https://github.com/openssl/openssl/commit/684400ce192dac51df3d3e92b61830a6ef90be3e

Source: cret@cert.org

https://github.com/openssl/openssl/commit/cb62ab4b17818fe66d2fed0a7fe71969131c811b

Source: cret@cert.org

https://kc.mcafee.com/corporate/index?page=content&id=SB10102

Source: cret@cert.org

https://kc.mcafee.com/corporate/index?page=content&id=SB10108

Source: cret@cert.org

https://support.apple.com/HT204659

Source: cret@cert.org

https://support.citrix.com/article/CTX216642

Source: cret@cert.org

https://www.openssl.org/news/secadv_20150108.txt

Source: cret@cert.org

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10679