[openssl-announce] OpenSSL Security Advisory
openssl at openssl.org
Thu Feb 16 12:21:24 UTC 2017
-----BEGIN PGP SIGNED MESSAGE-----
OpenSSL Security Advisory [16 Feb 2017]
Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)
During a renegotiation handshake if the Encrypt-Then-Mac extension is
negotiated where it was not in the original handshake (or vice-versa) then this
can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers
OpenSSL 1.1.0 users should upgrade to 1.1.0e
This issue does not affect OpenSSL version 1.0.2.
This issue was reported to OpenSSL on 31st January 2017 by Joe Orton (Red Hat).
The fix was developed by Matt Caswell of the OpenSSL development team.
Support for version 1.0.1 ended on 31st December 2016. Support for versions
0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer
receiving security updates.
URL for this Security Advisory:
Note: the online version of the advisory may be updated with additional details
For details of OpenSSL severity classifications please see:
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
More information about the openssl-announce