VULNERABILITY INTELLIGENCE

CVE-2015-1787

CVSS score2.6 LOW
EPSS probability5.89%
CISA KEVNot currently listed
Published2015-03-19
Last modified2026-06-17
CVSS vectorAV:N/AC:H/Au:N/C:N/I:N/A:P

Description

The ssl3_get_client_key_exchange function in s3_srvr.c in OpenSSL 1.0.2 before 1.0.2a, when client authentication and an ephemeral Diffie-Hellman ciphersuite are enabled, allows remote attackers to cause a denial of service (daemon crash) via a ClientKeyExchange message with a length of zero.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references