Subject: Re: CVE Request: OpenSSL NULL pointer dereference in do_ssl3_write
Date: Friday 2nd May 2014 20:33:12 UTC (over 4 years ago)
> On 05/02/2014 09:30 AM, Marc Deslauriers wrote: > > Hello, > > > > A null pointer dereference bug was discovered in so_ssl3_write(). > > An attacker could possibly use this to cause OpenSSL to crash, > > resulting in a denial of service. > > > > http://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321 > > > > > > http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib/libssl?id=e76e308f1fab2253ab5b4ef52a1865c5ffecdf21 > > > > > > http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/005_openssl.patch.sig > > > > Could a CVE please be assigned to this issue? > > > > Thanks, > > > > Marc. > > > > I think getting this one a CVE is time critical. Mitre: sorry if this > causes a duplicate, but I'm assigning a CVE now. Please use > CVE-2014-0198 for this issue. Also cc'ing Theo so OpenBSD gets > notified for sure. Speaking of which Theo: should we get you or an > OpenBSD deputy (Bob Beck?) onto [email protected]? "So OpenBSD gets notified for sure"... That is kind of weird. Read the commit message. It is originally from the OpenSSL lists. Do none of you read the lists? It's obvious the OpenSSL developers don't. The errata would have gone out same day Ted commited the fix, except I was in the Atlas mountains... and then it was forgotten until I got back home. I'm sure you've all got your "processes" for handling these things. But then you get paid for handling these things in some way, don't you? We don't get paid. And therefore, I don't know where I should find the time to be on another mailing list. It is not like I would have sent a mail to anyone. In general our processes are simply commit & publish. So I'll decline.