The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1...
High severity
Unreviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Jul 2, 2024
Description
Published by the National Vulnerability Database
Apr 7, 2014
Published to the GitHub Advisory Database
May 13, 2022
Last updated
Jul 2, 2024
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
References