Editing OpenSSL (section)

=== {{anchor|CVE-2015-0291}}ClientHello sigalgs DoS ===

This vulnerability ({{CVE|2015-0291}}) allows anyone to take a certificate, read its contents and modify it accurately to abuse the vulnerability causing a certificate to crash a client or server. If a client connects to an OpenSSL 1.0.2 server and renegotiates with an invalid signature algorithms extension, a null-pointer dereference occurs. This can cause a DoS attack against the server.

A Stanford Security researcher, David Ramos, had a private exploit and presented it to the OpenSSL team, which then patched the issue.

OpenSSL classified the bug as a high-severity issue, noting version 1.0.2 was found vulnerable.<ref>{{cite web |url=http://freedomhacker.net/openssl-patches-severe-denial-of-service-vulnerability-3818/ |title=OpenSSL Patches Severe Denial-of-Service Vulnerability |date=20 March 2015 |publisher=Brandon Stosh |df=mdy-all |access-date=March 20, 2015 |archive-date=April 2, 2015 |archive-url=https://web.archive.org/web/20150402102240/http://freedomhacker.net/openssl-patches-severe-denial-of-service-vulnerability-3818/ |url-status=live}}</ref>