CVE-2009-1378

Source
https://nvd.nist.gov/vuln/detail/CVE-2009-1378
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2009-1378.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2009-1378
Related
Published
2009-05-19T19:30:00Z
Modified
2024-06-30T12:01:22Z
Summary
[none]
Details

Multiple memory leaks in the dtls1processoutofseqmessage function in ssl/d1both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

References

Affected packages

Debian:11 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.8k-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:12 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.8k-1

Ecosystem specific

{
    "urgency": "low"
}

Debian:13 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.8k-1

Ecosystem specific

{
    "urgency": "low"
}