CVE-2014-3508 Information disclosure in n/a
Attackers can read sensitive stack memory via crafted X509 certificates when OpenSSL pretty printing is enabled, potentially exposing private data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-3508?
CVE-2014-3508 is a medium-severity vulnerability in Openssl Openssl, published on 13 Aug 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.
Weakness: CWE-200
Which versions are affected by CVE-2014-3508?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2014-3508?
Upgrade to a fixed version.
Is CVE-2014-3508 being exploited?
There is no known exploitation of CVE-2014-3508 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as DEBIAN-CVE-2014-3508, GHSA-5fxv-32q4-g2fh, UBUNTU-CVE-2014-3508.