CVE-2014-3508

medium · 4.3

The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.

4.3

CVSS

24.5%

EPSS (exploit prob.)

98th

EPSS percentile

2014-08-13

Published

AV:N/AC:M/Au:N/C:P/I:N/A:N

Weaknesses

CWE-200

Affected products

Vendor	Product	Affected versions
openssl	openssl	0.9.8
openssl	openssl	0.9.8a
openssl	openssl	0.9.8b
openssl	openssl	0.9.8c
openssl	openssl	0.9.8d
openssl	openssl	0.9.8e
openssl	openssl	0.9.8f
openssl	openssl	0.9.8g
openssl	openssl	0.9.8h
openssl	openssl	0.9.8i
openssl	openssl	0.9.8j
openssl	openssl	0.9.8k
openssl	openssl	0.9.8l
openssl	openssl	0.9.8m
openssl	openssl	0.9.8m
openssl	openssl	0.9.8n
openssl	openssl	0.9.8o
openssl	openssl	0.9.8p
openssl	openssl	0.9.8q
openssl	openssl	0.9.8r
openssl	openssl	0.9.8s
openssl	openssl	0.9.8t
openssl	openssl	0.9.8u
openssl	openssl	0.9.8v
openssl	openssl	0.9.8w
openssl	openssl	0.9.8x
openssl	openssl	0.9.8y
openssl	openssl	0.9.8za
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0
openssl	openssl	1.0.0a
openssl	openssl	1.0.0b
openssl	openssl	1.0.0c
openssl	openssl	1.0.0d
openssl	openssl	1.0.0e
openssl	openssl	1.0.0f

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-3508