Description

The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.

Remediation

References

CVE-2014-5139

Related Vulnerabilities

WebLogic Improper Input Validation Vulnerability (CVE-2020-10693)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7940)

Dot CMS Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-5344)

Django Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2019-14234)

Magento Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2019-7932)

Severity

Medium

Classification

CVE-2014-5139

Tags

Missing Update Known Vulnerabilities