openssl: multiple vulnerabilities
| Package(s): | openssl | CVE #(s): | CVE-2008-0891 CVE-2008-1672 | ||||||||||||||||||||||||||||
| Created: | May 29, 2008 | Updated: | January 8, 2009 | ||||||||||||||||||||||||||||
| Description: | From the Mandriva alert:
Testing using the Codenomicon TLS test suite discovered a flaw in the handling of server name extension data in OpenSSL 0.9.8f and OpenSSL 0.9.8g. If OpenSSL has been compiled using the non-default TLS server name extensions, a remote attacker could send a carefully crafted packet to a server application using OpenSSL and cause a crash. (CVE-2008-0891) Testing using the Codenomicon TLS test suite discovered a flaw if the 'Server Key exchange message' is omitted from a TLS handshake in OpenSSL 0.9.8f and OpenSSL 0.9.8g. If a client connects to a malicious server with particular cipher suites, the server could cause the client to crash. (CVE-2008-1672) | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||