Re: CVE Request: OpenSSL NULL pointer dereference in do_ssl3_write

[Theo de Raadt <deraadt () cvs openbsd org>]

> On 05/02/2014 09:30 AM, Marc Deslauriers wrote:
> > Hello,
> >
> > A null pointer dereference bug was discovered in so_ssl3_write().
> > An attacker could possibly use this to cause OpenSSL to crash,
> > resulting in a denial of service.
> >
> > http://rt.openssl.org/Ticket/Display.html?user=guest&pass=guest&id=3321
> >
> >  
> > http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib/libssl?id=e76e308f1fab2253ab5b4ef52a1865c5ffecdf21
> >
> >  
> > http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/005_openssl.patch.sig
> >
> >  Could a CVE please be assigned to this issue?
> >
> > Thanks,
> >
> > Marc.
>
> I think getting this one a CVE is time critical. Mitre: sorry if this
> causes a duplicate, but I'm assigning a CVE now. Please use
> CVE-2014-0198 for this issue. Also cc'ing Theo so OpenBSD gets
> notified for sure. Speaking of which Theo: should we get you or an
> OpenBSD deputy (Bob Beck?) onto distros@?

"So OpenBSD gets notified for sure"... That is kind of weird.  Read
the commit message.  It is originally from the OpenSSL lists.  Do none
of you read the lists?  It's obvious the OpenSSL developers don't.

The errata would have gone out same day Ted commited the fix, except I
was in the Atlas mountains... and then it was forgotten until I got
back home.

I'm sure you've all got your "processes" for handling these things.
But then you get paid for handling these things in some way, don't
you?

We don't get paid.  And therefore, I don't know where I should find
the time to be on another mailing list.  It is not like I would have
sent a mail to anyone.  In general our processes are simply commit &
publish.  So I'll decline.