Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 16 Mar 2015 21:16:21 +0100
From: Vitezslav Cizek <civ@...ma.cz>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: memory leak in openssl "hostname"
 TLS Extension

* Dne Monday 16. March 2015, 09:04:38 [CET] Marcus Meissner napsal:
> Hi,
> 
> Reported to us by a customer.
> 
> The "hostname" TLS extension in openssl had a memory leak, fixed in 2009:
> 
> https://github.com/openssl/openssl/commit/7587347bc48e7e8a1e800e48bb0a658f1557c424
> 
> commit 7587347bc48e7e8a1e800e48bb0a658f1557c424
> Author: Ben Laurie <ben@...nssl.org>
> Date:   Mon Feb 23 16:40:59 2009 +0000
> 
>     Fix memory leak.
> 
> Fixed in 0.9.8g. (did not check 0.9.7, the extension was introduced in the 0.9.7 lifetime somewhen)

That's not correct.
It wasn't fixed until 0.9.8k.

The release it appeared in was 0.9.8f.
Introduced to 0.9.8 branch by:

commit 865a90eb4f0b0e3abbdd9dc2d3a4d57595575315
Author: Dr. Stephen Henson <steve@...nssl.org>
Date:   Sun Aug 12 18:59:03 2007 +0000

    Backport of TLS extension code to OpenSSL 0.9.8.

--
Vita Cizek

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ