oss-security - Re: CVE Request: OpenSSL NULL pointer dereference in do_ssl3

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <201405022033.s42KXCN8017238@cvs.openbsd.org>
Date: Fri, 02 May 2014 14:33:12 -0600
From: Theo de Raadt <deraadt@....openbsd.org>
To: kseifried@...hat.com
cc: oss-security@...ts.openwall.com,
        Assign a CVE Identifier <cve-assign@...re.org>, theo@....openbsd.org
Subject: Re: CVE Request: OpenSSL NULL pointer dereference in do_ssl3_write

> On 05/02/2014 09:30 AM, Marc Deslauriers wrote:
> > Hello,
> > 
> > A null pointer dereference bug was discovered in so_ssl3_write().
> > An attacker could possibly use this to cause OpenSSL to crash,
> > resulting in a denial of service.
> > 
> > http://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321
> >
> >  
> > http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib/libssl?id=e76e308f1fab2253ab5b4ef52a1865c5ffecdf21
> >
> >  
> > http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/005_openssl.patch.sig
> >
> >  Could a CVE please be assigned to this issue?
> > 
> > Thanks,
> > 
> > Marc.
> > 
> 
> I think getting this one a CVE is time critical. Mitre: sorry if this
> causes a duplicate, but I'm assigning a CVE now. Please use
> CVE-2014-0198 for this issue. Also cc'ing Theo so OpenBSD gets
> notified for sure. Speaking of which Theo: should we get you or an
> OpenBSD deputy (Bob Beck?) onto distros@?

"So OpenBSD gets notified for sure"... That is kind of weird.  Read
the commit message.  It is originally from the OpenSSL lists.  Do none
of you read the lists?  It's obvious the OpenSSL developers don't.

The errata would have gone out same day Ted commited the fix, except I
was in the Atlas mountains... and then it was forgotten until I got
back home.

I'm sure you've all got your "processes" for handling these things.
But then you get paid for handling these things in some way, don't
you?

We don't get paid.  And therefore, I don't know where I should find
the time to be on another mailing list.  It is not like I would have
sent a mail to anyone.  In general our processes are simply commit &
publish.  So I'll decline.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.