CVE-2015-3194

Impact:
Low
Public Date:
2016-01-28
IAVA:
2016-A-0030, 2016-A-0228, 2016-A-0229, 2016-A-0293
Bugzilla:
1288320: CVE-2015-3194 OpenSSL: Certificate verify crash with missing PSS parameter
A NULL pointer dereference flaw was found in the way OpenSSL verified signatures using the RSA PSS algorithm. A remote attacker could possibly use this flaw to crash a TLS/SSL client using OpenSSL, or a TLS/SSL server using OpenSSL if it enabled client authentication.

Find out more about CVE-2015-3194 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 5.8
Base Metrics AV:N/AC:M/Au:N/C:P/I:P/A:N
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat JBoss Core Services 1 RHSA-2016:2957 2016-12-15
Red Hat Enterprise Linux 7 (openssl) RHSA-2015:2617 2015-12-14
Red Hat Enterprise Linux 6 (openssl) RHSA-2015:2617 2015-12-14

Affected Packages State

Platform Package State
Red Hat JBoss Web Server 3.0 openssl Fix deferred
Red Hat JBoss EWS 2 openssl Not affected
Red Hat JBoss EWS 1 openssl Not affected
Red Hat JBoss EAP 6 openssl Not affected
Red Hat Enterprise Linux 7 openssl098e Will not fix
Red Hat Enterprise Linux 6 openssl098e Will not fix
Red Hat Enterprise Linux 5 openssl Affected
Red Hat Enterprise Linux 5 openssl097a Will not fix

Mitigation

External References

Last Modified