CVE-2015-0293
Last modified
CVE-2015-0293 is a vulnerability of currently unknown severity. The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.. EPSS estimates a 21.39% chance of exploitation in the next 30 days.
Description
The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via a crafted CLIENT-MASTER-KEY message.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openssl | Openssl | <= 0.9.8ze |
| Openssl | Openssl | 1.0.0 |
| Openssl | Openssl | 1.0.0a |
| Openssl | Openssl | 1.0.0b |
| Openssl | Openssl | 1.0.0c |
| Openssl | Openssl | 1.0.0d |
| Openssl | Openssl | 1.0.0e |
| Openssl | Openssl | 1.0.0f |
| Openssl | Openssl | 1.0.0g |
| Openssl | Openssl | 1.0.0h |
| Openssl | Openssl | 1.0.0i |
| Openssl | Openssl | 1.0.0j |
| Openssl | Openssl | 1.0.0k |
| Openssl | Openssl | 1.0.0l |
| Openssl | Openssl | 1.0.0m |
| Openssl | Openssl | 1.0.0n |
| Openssl | Openssl | 1.0.0o |
| Openssl | Openssl | 1.0.0p |
| Openssl | Openssl | 1.0.0q |
| Openssl | Openssl | 1.0.1 |
| Openssl | Openssl | 1.0.1a |
| Openssl | Openssl | 1.0.1b |
| Openssl | Openssl | 1.0.1c |
| Openssl | Openssl | 1.0.1d |
| Openssl | Openssl | 1.0.1e |
| Openssl | Openssl | 1.0.1f |
| Openssl | Openssl | 1.0.1g |
| Openssl | Openssl | 1.0.1h |
| Openssl | Openssl | 1.0.1i |
| Openssl | Openssl | 1.0.1j |
| Openssl | Openssl | 1.0.1k |
| Openssl | Openssl | 1.0.1l |
| Openssl | Openssl | 1.0.2 |
References
- https://www.openssl.org/news/secadv_20150319.txtVendor Advisory
- https://www.openssl.org/news/secadv_20150319.txtVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2015-0293?
How severe is CVE-2015-0293?
How do I fix CVE-2015-0293?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2015
- CVE-2015-0287The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in O…
- CVE-2015-0288The X509_to_X509_REQ function in crypto/x509/x509_req.c in O…
- CVE-2015-0289The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 b…
- CVE-2015-0290The multi-block feature in the ssl3_write_bytes function in …
- CVE-2015-0291The sigalgs implementation in t1_lib.c in OpenSSL 1.0.2 befo…
- CVE-2015-0292Integer underflow in the EVP_DecodeUpdate function in crypto…
- CVE-2015-0294GnuTLS before 3.3.13 does not validate that the signature al…7.5
- CVE-2015-0295The BMP decoder in QtGui in QT before 5.5 does not properly …
- CVE-2015-0296The pre-install script in texlive 3.1.20140525_r34255.fc21 a…
- CVE-2015-0297Red Hat JBoss Operations Network 3.3.1 does not properly res…
- CVE-2015-0298Cross-site scripting (XSS) vulnerability in the manager web …
- CVE-2015-0299Multiple cross-site scripting (XSS) vulnerabilities in Open …
Are you affected by CVE-2015-0293?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST