body { transform: translateY(0) !important; }

Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2010-4252

Published: 6 December 2010

OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.

Notes

Author	Note
jdstrand	Ubuntu 10.04 LTS and later have J-PAKE code, but openssl is compiled with OPENSSL_NO_JPAKE

Priority

Status

Package	Release	Status
openssl Launchpad, Ubuntu, Debian	dapper	Not vulnerable (code not present)
	hardy	Not vulnerable (code not present)
	karmic	Not vulnerable (code not present)
	lucid	Not vulnerable (code not compiled)
	maverick	Not vulnerable (code not compiled)
	upstream	Needs triage

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Further reading