The following was reported by OpenSSL upstream:
When processing an ECParameters structure OpenSSL enters an infinite loop if
the curve specified is over a specially malformed binary polynomial field.
This can be used to perform denial of service against any
system which processes public keys, certificate requests or
certificates. This includes TLS clients and TLS servers with
client authentication enabled.
This issue affects OpenSSL versions: 1.0.2 and 1.0.1. Recent
1.0.0 and 0.9.8 versions are not affected. 1.0.0d and 0.9.8r and below are
OpenSSL 1.0.2 users should upgrade to 1.0.2b
OpenSSL 1.0.1 users should upgrade to 1.0.1n
OpenSSL 1.0.0d (and below) users should upgrade to 1.0.0s
OpenSSL 0.9.8r (and below) users should upgrade to 0.9.8zg
This issue was reported to OpenSSL on 6th April 2015 by Joseph Birr-Pixton. The
fix was developed by Andy Polyakov of the OpenSSL development team.
Red Hat would like to thank the OpenSSL project for reporting this issue.
Created attachment 1035150 [details]
Proposed patch for CVE-2015-1788
Note that this issue does not affect RHEL and Fedora as we remove the ECC support for the binary curves (GF(2m)).
Not vulnerable. This issue does not affect the versions of openssl package as shipped with Red Hat Enterprise Linux 5, 6 and 7.
This issue does not affect the versions of openssl package as shipped with Fedora 21 and 22.
A blog post about this issue form the original reporter, which also provides a reproducer: