{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/200","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/200/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/200/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/200/events","html_url":"https://github.com/chrsmith/google-security-research/issues/200","id":58937193,"number":200,"title":"LibreSSL vulnerable to Denial-of-Service (null pointer dereference)","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CCProjectZeroMembers","name":"CCProjectZeroMembers","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-groebert","name":"Finder-groebert","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Fixed-2014-Dec-08","name":"Fixed-2014-Dec-08","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/ISE-TPS-bug","name":"ISE-TPS-bug","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-LibreSSL","name":"Product-LibreSSL","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Nov-26","name":"Reported-2014-Nov-26","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-Low","name":"Severity-Low","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-LibreSSL","name":"Vendor-LibreSSL","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-02-25T17:17:40Z","updated_at":"2015-02-25T17:17:42Z","closed_at":"2015-02-25T17:17:40Z","body":"```\nDear LibreSSL developers,\n\nwe identified a minor security issues in libressl-2.1.1.\n\nPlease confirm at your earliest convenience that you have received this \nvulnerability report. We will gladly work with you so you can successfully \nconfirm and reproduce this issue.\n\nAlso note that this bug is NOT subject to a 90 day disclosure deadline. This is \nbecause exploitability is unlikely.\n\nIn the case you chose not to fix these issues please provide data points as we \nmay make public all this information. In that case, we understand you will have \nno problem having this information public.\n\nOnce you have reproduced the issue, we’d appreciate to learn your expected \ntimeline for a security update to be released. With any fix, please give credit \nfor identifying the vulnerability to \"Felix Groebert of the Google Security \nTeam\".\n\nDon’t hesitate to let us know if you have any questions!\n\nLibreSSL is vulnerable to CVE-2014-3510. From the CVE:\n\nThe ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before \n0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS \nservers to cause a denial of service (NULL pointer dereference and client \napplication crash) via a crafted handshake message in conjunction with a (1) \nanonymous DH or (2) anonymous ECDH ciphersuite.\n\nhttps://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff;f=ssl/s3_clnt.c;h=0a006\na75342893fd4f2fdd30f930ec220b7694fa;hp=9a94de00d8492a292995a90b3f0c45b1fe85e087;\nhb=17160033765480453be0a41335fa6b833691c049;hpb=280b1f1ad12131defcd986676a8fc971\n7aaa601b\n\nUsing specific anonymous cipher suites will result in a null pointer \ndereference in d1_clnt.c on line 988 and 1072 in function \ndtls1_send_client_key_exchange.\n\n988                             if (s->session->sess_cert->peer_dh_tmp != NULL)\n\n(gdb) p s->session->sess_cert\n$1 = (struct sess_cert_st *) 0x0\n\nWe recommend to check if sess_cert is non NULL.\n\nCheers\nFelix\n```\n\n-----\nOriginal issue reported on code.google.com by `groeb...@google.com` on 26 Nov 2014 at 9:22"},"comment":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/comments/76007465","html_url":"https://github.com/chrsmith/google-security-research/issues/200#issuecomment-76007465","issue_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/200","id":76007465,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T17:17:42Z","updated_at":"2015-02-25T17:17:42Z","body":"\n\n-----\nOriginal comment by `groeb...@google.com` on 12 Dec 2014 at 9:06\n* Added labels: **Fixed-2014-Dec-08**\n* Removed labels: **Fixed-2014-Nov-19**"}}