Editing OpenSSL (section)

=== OCSP stapling vulnerability ===

When creating a handshake, the client could send an incorrectly formatted ClientHello message, leading to OpenSSL parsing more than the end of the message. Assigned the identifier {{CVE|2011-0014}} by the CVE project, this affected all OpenSSL versions 0.9.8h to 0.9.8q and OpenSSL 1.0.0 to 1.0.0c. Since the parsing could lead to a read on an incorrect memory address, it was possible for the attacker to cause a [[Denial-of-service attack|DoS]]. It was also possible that some applications expose the contents of parsed [[OCSP]] extensions, leading to an attacker being able to read the contents of memory that came after the ClientHello.<ref>{{cite web|title=OpenSSL Updates Fix Critical Security Vulnerabilities|date=9 August 2014|url=https://blogs.comodo.com/it-security/openssl-updates-fix-critical-security-vulnerabilities/|access-date=25 August 2014|df=mdy-all|archive-date=August 26, 2014|archive-url=https://web.archive.org/web/20140826120554/https://blogs.comodo.com/it-security/openssl-updates-fix-critical-security-vulnerabilities/|url-status=dead}}</ref>