CVE-2009-1378
NoneCVSS
—
EPSS
12.7%
Published
May 19, 2009
CISA due date
—
The record
Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | openssl | 0 | 0.9.8k-1 |
| Debian:11 | openssl | 0 | 0.9.8k-1 |
| Debian:12 | openssl | 0 | 0.9.8k-1 |
| Debian:13 | openssl | 0 | 0.9.8k-1 |
| Debian:14 | openssl | 0 | 0.9.8k-1 |
| Red Hat:enterprise_linux:5::client | openssl | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::client | openssl-debuginfo | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::client | openssl-devel | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::client | openssl-perl | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::client_workstation | openssl | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::client_workstation | openssl-debuginfo | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::client_workstation | openssl-devel | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::client_workstation | openssl-perl | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::server | openssl | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::server | openssl-debuginfo | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::server | openssl-devel | 0 | 0:0.9.8e-12.el5 |
| Red Hat:enterprise_linux:5::server | openssl-perl | 0 | 0:0.9.8e-12.el5 |
| openSUSE:Tumbleweed | openssl-1_1 | 0 | 1.1.1l-1.2 |
Related vulnerabilities
- CVE-2022-0778 The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can… Also affects openssl
- CVE-2021-3712 ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which… Also affects openssl
- CVE-2021-3449 An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello… Also affects openssl
- CVE-2021-23840 Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the… Also affects openssl
- CVE-2020-1971 The X.509 GeneralName type is a generic type for representing different types of names. Also affects openssl
- CVE-2020-1967 Server or client applications that call the SSL_check_chain() function during or after a… Also affects openssl
- CVE-2019-1551 There is an overflow bug in the x64_64 Montgomery squaring procedure used in… Also affects openssl
- CVE-2019-1547 Normally in OpenSSL EC groups always have a co-factor present and this is used in side… Also affects openssl