CVE-2014-8628

Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue.

CVSS v2.0 7.8 HIGH

7.8^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html
http://www.debian.org/security/2014/dsa-3116
https://polarssl.org/tech-updates/releases/polarssl-1.2.12-released
https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:polarssl:polarssl::::::::
	cpe:2.3:a:polarssl:polarssl:1.3.0:::::::*
	cpe:2.3:a:polarssl:polarssl:1.3.1:::::::*
	cpe:2.3:a:polarssl:polarssl:1.3.2:::::::*
	cpe:2.3:a:polarssl:polarssl:1.3.3:::::::*
	cpe:2.3:a:polarssl:polarssl:1.3.4:::::::*
	cpe:2.3:a:polarssl:polarssl:1.3.5:::::::*
	cpe:2.3:a:polarssl:polarssl:1.3.6:::::::*
	cpe:2.3:a:polarssl:polarssl:1.3.7:::::::*
	cpe:2.3:a:polarssl:polarssl:1.3.8:::::::*

History

07 Nov 2023, 02:22

Type	Values Removed	Values Added
References	~~(CONFIRM) https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released - Vendor Advisory~~	() https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released -
References	~~(CONFIRM) https://polarssl.org/tech-updates/releases/polarssl-1.2.12-released - Vendor Advisory~~	() https://polarssl.org/tech-updates/releases/polarssl-1.2.12-released -
References	~~(DEBIAN) http://www.debian.org/security/2014/dsa-3116 -~~	() http://www.debian.org/security/2014/dsa-3116 -
References	~~(SUSE) http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html -~~	() http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html -

Information

Published : 2015-08-24 15:59

Updated : 2023-12-10 11:46

NVD link : CVE-2014-8628

Mitre link : CVE-2014-8628

CVE.ORG link : CVE-2014-8628

JSON object : View

Products Affected

polarssl

polarssl

CWE

CWE-399

Resource Management Errors

{"id": "CVE-2014-8628", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-08-24T15:59:00.090", "references": [{"url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00079.html", "source": "security@opentext.com"}, {"url": "http://www.debian.org/security/2014/dsa-3116", "source": "security@opentext.com"}, {"url": "https://polarssl.org/tech-updates/releases/polarssl-1.2.12-released", "source": "security@opentext.com"}, {"url": "https://polarssl.org/tech-updates/releases/polarssl-1.3.9-released", "source": "security@opentext.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted X.509 certificates. NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2014-9744 for the ClientHello message issue."}, {"lang": "es", "value": "Vulnerabilidad de fuga de memoria en PolarSSL en versiones anteriores a 1.2.12 y 1.3.x en versiones anteriores a 1.3.9, permite a atacantes remotos causar una denegaci\u00f3n de servicio (consumo de memoria) a trav\u00e9s de una gran cantidad de certificados X.509 manipulados. NOTA: este identificador ha sido SEPARADO por ADT3 debido a las diferentes versiones afectadas. Ver CVE-2014-9744 para el caso de mensaje ClientHello."}], "lastModified": "2023-11-07T02:22:39.873", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:polarssl:polarssl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21C4BF72-F3E9-49F7-BC63-55D85D82EC63", "versionEndIncluding": "1.2.11"}, {"criteria": "cpe:2.3:a:polarssl:polarssl:1.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9400165F-7CA8-43B6-9C18-A9B68960C69D"}, {"criteria": "cpe:2.3:a:polarssl:polarssl:1.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F27E26E-D912-462A-AE70-90AA058B9DDF"}, {"criteria": "cpe:2.3:a:polarssl:polarssl:1.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FEB54854-6DC9-44B9-A94A-671C17C1F0A9"}, {"criteria": "cpe:2.3:a:polarssl:polarssl:1.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "495BE6FC-806F-489E-85EF-5F6CF3E6B068"}, {"criteria": "cpe:2.3:a:polarssl:polarssl:1.3.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E56EC828-5984-4800-B366-3E3A2ED4A397"}, {"criteria": "cpe:2.3:a:polarssl:polarssl:1.3.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC0A5B11-E428-4B81-8125-4C26DC42733F"}, {"criteria": "cpe:2.3:a:polarssl:polarssl:1.3.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B085B300-6A08-4649-AB6A-167761D3138A"}, {"criteria": "cpe:2.3:a:polarssl:polarssl:1.3.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1F43435-B2E1-4CF5-A7B7-0FD50C905783"}, {"criteria": "cpe:2.3:a:polarssl:polarssl:1.3.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A69FA32E-55FE-4F00-B209-D31B88986B5E"}], "operator": "OR"}]}], "sourceIdentifier": "security@opentext.com"}