CVE-2015-0289: OpenSSL

Medium severity, CVSS 5.0. EPSS: 8.4% chance of exploitation in the next 30 days.

The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an application that processes arbitrary PKCS#7 data and providing malformed data with ASN.1 encoding, related to crypto/pkcs7/pk7_doit.c and crypto/pkcs7/pk7_lib.c.

Affected products

• OpenSSL OpenSSL: up to and including 0.9.8ze; version 1.0.0 only; version 1.0.0a only; version 1.0.0b only; version 1.0.0c only; version 1.0.0d only; …

Published 2015-03-19. Last modified 2026-06-17.