The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Metrics
Affected Vendors & Products
References
History
Tue, 13 Aug 2024 23:45:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2014-04-07T00:00:00
Updated: 2024-08-06T09:05:39.056Z
Reserved: 2013-12-03T00:00:00
Link: CVE-2014-0160
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2014-04-07T22:55:03.893
Modified: 2024-07-02T16:52:39.560
Link: CVE-2014-0160
Redhat