CVE-2014-0221

Publication date 5 June 2014

Last updated 24 July 2024

Ubuntu priority

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssl	14.04 LTS trusty	Fixed 1.0.1f-1ubuntu2.2
	13.10 saucy	Fixed 1.0.1e-3ubuntu1.4
	12.04 LTS precise	Fixed 1.0.1-4ubuntu5.14
	10.04 LTS lucid	Fixed 0.9.8k-7ubuntu8.18
openssl098	14.04 LTS trusty	Fixed 0.9.8o-7ubuntu3.2.14.04.1
	13.10 saucy	Fixed 0.9.8o-7ubuntu3.2.13.10.1
	12.04 LTS precise	Fixed 0.9.8o-7ubuntu3.2
	10.04 LTS lucid	Not in release

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-2232-1
OpenSSL vulnerabilities
5 June 2014

Other references

https://www.openssl.org/news/secadv_20140605.txt
https://www.cve.org/CVERecord?id=CVE-2014-0221