[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 14 Jul 2015 17:08:08 +0200
From: Markus Vervier <markus.vervier@...xperts.de>
To: oss-security@...ts.openwall.com
Subject: CVE Request: AWS s2n
Hi,
I would like to request a CVE for s2n.
When a server is sending invalid DH values during a handshake a BIGNUM
value is not properly initialized. This causes a null pointer
dereference in a s2n based client leading to a crash or possible worse
on old systems (e.g. on Debian kernels lower than 2.6.26).
Technical details and a patch are available here:
https://github.com/awslabs/s2n/pull/124
The fix was merged and is in commit
9af6ba1815dfd5c00361cc3bd45cee1d64e0c3bf.
Markus
--
Markus Vervier (IT Security Consultant and Software Developer),
http://www.lsexperts.de
LSE Leading Security Experts GmbH, Postfach 100121, 64201 Darmstadt
Tel.: +49 (0) 6151 86086-261, Fax: -299,
Unternehmenssitz: Weiterstadt, Amtsgericht Darmstadt: HRB8649
Geschäftsführer: Oliver Michel, Sven Walther
Download attachment "smime.p7s" of type "application/pkcs7-signature" (4238 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
