A double free vulnerability was identified in the OpenSSL DTLS code when an attacker forces an error condition. This issue affects both client and server code.
External References: https://www.openssl.org/news/secadv_20140806.txt
Upstream commit: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bff1ce4e6a1c57c3d0a5f9e4f85ba6385fccfe8b
Created openssl tracking bugs for this issue: Affects: fedora-all [bug 1127704]
Created mingw-openssl tracking bugs for this issue: Affects: fedora-all [bug 1127705]
Created mingw-openssl tracking bugs for this issue: Affects: epel-7 [bug 1127709]
openssl-1.0.1e-39.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
openssl-1.0.1e-39.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Upstream vulnerabilities page now lists only versions starting with 0.9.8m as affected by this issue. It seems the reason is the following change, that introduced the problem: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff;f=ssl/d1_both.c;h=0a5c08d;hb=f86d651;hpb=efa59b8 http://cvs.openssl.org/filediff?f=openssl/ssl/d1_both.c&v1=1.4.2.11&v2=1.4.2.15 Before the change, it was not possible to reach the "err" goto label with item != NULL in dtls1_process_out_of_seq_message() so the OPENSSL_free(item) was never called there. While this change was introduced upstream in 0.9.8m, it was also backported to Red Hat Enterprise Linux 5 openssl packages based on upstream version 0.9.8e, as the change was the fix for CVE-2009-1378 (bug 501254). It was first included in openssl packages released via RHSA-2009:1335 as part of the Red Hat Enterprise Linux 5.4 minor release. The other part of the CVE-2014-3505 fix - the dtls1_reassemble_fragment() change - is only applicable to upstream versions 0.9.8o and 1.0.0a, that include following fixes for the DTLS fragment handling: https://rt.openssl.org/Ticket/Display.html?id=2230&user=guest&pass=guest https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c713a4c https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1507f3a
IssueDescription: A flaw was discovered in the way OpenSSL handled DTLS packets. A remote attacker could use this flaw to cause a DTLS server or client using OpenSSL to crash or use excessive amounts of memory.
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2014:1053 https://rhn.redhat.com/errata/RHSA-2014-1053.html
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2014:1052 https://rhn.redhat.com/errata/RHSA-2014-1052.html
This issue has been addressed in following products: Red Hat Storage 2.1 Via RHSA-2014:1054 https://rhn.redhat.com/errata/RHSA-2014-1054.html
This issue has been addressed in the following products: JBoss Web Server 2.1.0 Via RHSA-2014:1256 https://rhn.redhat.com/errata/RHSA-2014-1256.html
This issue has been addressed in the following products: JBoss Enterprise Application Platform 6.3.0 Via RHSA-2014:1297 https://rhn.redhat.com/errata/RHSA-2014-1297.html