Date: Tue, 14 Jul 2015 17:08:08 +0200 From: Markus Vervier <markus.vervier@...xperts.de> To: oss-security@...ts.openwall.com Subject: CVE Request: AWS s2n Hi, I would like to request a CVE for s2n. When a server is sending invalid DH values during a handshake a BIGNUM value is not properly initialized. This causes a null pointer dereference in a s2n based client leading to a crash or possible worse on old systems (e.g. on Debian kernels lower than 2.6.26). Technical details and a patch are available here: https://github.com/awslabs/s2n/pull/124 The fix was merged and is in commit 9af6ba1815dfd5c00361cc3bd45cee1d64e0c3bf. Markus -- Markus Vervier (IT Security Consultant and Software Developer), http://www.lsexperts.de LSE Leading Security Experts GmbH, Postfach 100121, 64201 Darmstadt Tel.: +49 (0) 6151 86086-261, Fax: -299, Unternehmenssitz: Weiterstadt, Amtsgericht Darmstadt: HRB8649 Geschäftsführer: Oliver Michel, Sven Walther Download attachment "smime.p7s" of type "application/pkcs7-signature" (4238 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.