oss-security - CVE Request: memory leak in openssl "hostname" TLS Extension

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150316080438.GC13194@suse.de>
Date: Mon, 16 Mar 2015 09:04:38 +0100
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE Request: memory leak in openssl "hostname" TLS Extension

Hi,

Reported to us by a customer.

The "hostname" TLS extension in openssl had a memory leak, fixed in 2009:

https://github.com/openssl/openssl/commit/7587347bc48e7e8a1e800e48bb0a658f1557c424

commit 7587347bc48e7e8a1e800e48bb0a658f1557c424
Author: Ben Laurie <ben@...nssl.org>
Date:   Mon Feb 23 16:40:59 2009 +0000

    Fix memory leak.

Fixed in 0.9.8g. (did not check 0.9.7, the extension was introduced in the 0.9.7 lifetime somewhen)

1.0.0 and 1.0.1 already contained the fix as they shipped.

Ciao, Marcus

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.