The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssl | Openssl | 1.0.0a (including) | 1.0.0a (including) |
| Openssl | Openssl | 1.0.0b (including) | 1.0.0b (including) |
| Openssl | Openssl | 1.0.0c (including) | 1.0.0c (including) |
| Openssl | Openssl | 1.0.0d (including) | 1.0.0d (including) |
| Openssl | Openssl | 1.0.0e (including) | 1.0.0e (including) |
| Openssl | Openssl | 1.0.0f (including) | 1.0.0f (including) |
| Openssl | Openssl | 1.0.0g (including) | 1.0.0g (including) |
| Openssl | Openssl | 1.0.0h (including) | 1.0.0h (including) |
| Openssl | Openssl | 1.0.0i (including) | 1.0.0i (including) |
| Openssl | Openssl | 1.0.0j (including) | 1.0.0j (including) |
| Openssl | Openssl | 1.0.0k (including) | 1.0.0k (including) |
| Openssl | Openssl | 1.0.0l (including) | 1.0.0l (including) |
| Openssl | Openssl | 1.0.0m (including) | 1.0.0m (including) |
| Openssl | Openssl | 1.0.0n (including) | 1.0.0n (including) |
| Openssl | Openssl | 1.0.0o (including) | 1.0.0o (including) |
| Openssl | Openssl | 1.0.1a (including) | 1.0.1a (including) |
| Openssl | Openssl | 1.0.1b (including) | 1.0.1b (including) |
| Openssl | Openssl | 1.0.1c (including) | 1.0.1c (including) |
| Openssl | Openssl | 1.0.1d (including) | 1.0.1d (including) |
| Openssl | Openssl | 1.0.1e (including) | 1.0.1e (including) |
| Openssl | Openssl | 1.0.1f (including) | 1.0.1f (including) |
| Openssl | Openssl | 1.0.1g (including) | 1.0.1g (including) |
| Openssl | Openssl | 1.0.1h (including) | 1.0.1h (including) |
| Openssl | Openssl | 1.0.1i (including) | 1.0.1i (including) |
| Openssl | Openssl | 1.0.1j (including) | 1.0.1j (including) |
| Red Hat Enterprise Linux 6 | RedHat | openssl-0:1.0.1e-30.el6_6.5 | * |
| Red Hat Enterprise Linux 7 | RedHat | openssl-1:1.0.1e-34.el7_0.7 | * |
| Openssl | Ubuntu | devel | * |
| Openssl | Ubuntu | trusty | * |
| Openssl | Ubuntu | upstream | * |
| Openssl | Ubuntu | utopic | * |