Is CVE-2024-5535 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-5535 being exploited in the wild.

How severe is CVE-2024-5535?

Critical severity, with a CVSS score of 9.1, published 27 June 2024.

Which products and versions are affected?

OpenSSL 3.3, 3.2, 3.1, 3.0, 1.1.1, 1.0.2.

Is there a fix for CVE-2024-5535?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-5535 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-5535?

Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-5535: OpenSSL buffer overread in SSL_select_next_proto

CVE-2024-5535 · Severity: critical · CVSS 9.1 · Published 2024-06-27

OpenSSL is a widely used security library that enables encrypted communications for websites and applications. A flaw in how it handles certain network protocol negotiations could allow an attacker to cause a service crash or potentially steal up to 255 bytes of private memory data. This issue primarily affects applications with specific configuration errors or those using the older, deprecated NPN protocol.

Technologies: OpenSSL. Vendors: OpenSSL.

Quick answers

Is CVE-2024-5535 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-5535 being exploited in the wild.
How severe is CVE-2024-5535?: Critical severity, with a CVSS score of 9.1, published 27 June 2024.
Which products and versions are affected?: OpenSSL 3.3, 3.2, 3.1, 3.0, 1.1.1, 1.0.2.
Is there a fix for CVE-2024-5535?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-5535 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-5535?: Check whether you run OpenSSL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A buffer overread exists in the SSL_select_next_proto function when it is called with a zero-length client protocols buffer. The function fails to validate the buffer length and, in the event of no protocol overlap, returns a pointer to memory immediately following the empty buffer. This typically occurs during ALPN or NPN negotiation callbacks. While libssl prevents this in standard ALPN usage, custom application logic or NPN implementations that pass a 0-length list are vulnerable. An attacker could potentially receive up to 255 bytes of arbitrary memory from the process. The fix implements stricter length checking for both client and server protocol lists.

Affected products

OpenSSL OpenSSL 3.3, 3.2, 3.1, 3.0, 1.1.1, 1.0.2

Timeline

2024-06-27: advisory: OpenSSL Security Advisory published
2024-06-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.