openssl-1.0.1e-16.AXS4.4

The OpenSSL toolkit provides support for secure communications between machines. OpenSSL includes a certificate management tool and shared libraries which provide various cryptographic algorithms and protocols.

• CVE-2013-4353
The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake.

• CVE-2013-6449
The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.

• CVE-2013-6450
The DTLS retransmission implementation in OpenSSL through 0.9.8y and 1.x through 1.0.1e does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.

Fixed bugs:

• As part of upgrading to version 1.0.1, some shared library symbols has been removed. This caused a problem with Ruby language OpenSSL bindings. The missing symbols have been added.

• Previously, openssl ran RDRAND instructions on Cyrix CPUs. Those are not supported and the OpenSSL would crash on startup. This Cyrix CPU detection has been fixed and OpenSSL runs as expected on Cyrix CPUs.

• Previously, the Transport Layer Security advertised some elliptic curves that are unsupported. When the server chose them, the client could not communicate with the server. This has been fixed: the TLS client now only advertises supported curves.