The following flaw was found in PolarSSL: During the parsing of a ASN.1 sequence, a pointer in the linked list of asn1_sequence is not initialized by asn1_get_sequence_of(). In case an error occurs during parsing of the list, a situation is created where the uninitialized pointer is passed to polarssl_free(). This sequence can be triggered when a PolarSSL entity is parsing a certificate. So practically this means clients when receiving a certificate from the server or servers in case they are actively asking for a client certificate. Depending on the attackers knowledge of the system under attack, this results at the lowest into a Denial of Service, and at the most a possible Remote Code Execution. The patch for this issue is provided in the PolarSSL Security Advisory 2014-04 referenced below. External References: https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04
Created polarssl tracking bugs for this issue: Affects: fedora-all [bug 1184029] Affects: epel-all [bug 1184030]
Fedora updates: https://admin.fedoraproject.org/updates/polarssl-1.2.12-3.fc20 https://admin.fedoraproject.org/updates/polarssl-1.3.9-3.fc21 Fedora-EPEL updates: https://admin.fedoraproject.org/updates/polarssl-1.3.2-4.el5 https://admin.fedoraproject.org/updates/polarssl-1.3.2-4.el6 https://admin.fedoraproject.org/updates/polarssl-1.3.9-3.el7
polarssl-1.2.12-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
polarssl-1.3.9-3.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
polarssl-1.3.2-4.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report.
polarssl-1.3.9-3.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
polarssl-1.3.2-4.el6 has been pushed to the Fedora EPEL 6 stable repository. If problems still persist, please make note of it in this bug report.