CVE-2008-1672
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS...
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
Exploit likelihood
What each source reports
NVD Score used
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
- Record
CVE-2008-1672- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
CVE List No score
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
- Record
CVE-2008-1672- Updated
- 2026-11-02
EUVDEUVD-2008-1673 No score
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
- Record
EUVD-2008-1673- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-322g-pxmj-97cc No score
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS...
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
- Record
GHSA-322g-pxmj-97cc- Weakness
- CWE-476
- Updated
- 2026-11-02
OSV No score
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
- Record
CVE-2008-1672- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1672 No score
OpenSSL 0.9.8f and 0.9.8g allows remote attackers to cause a denial of service (crash) via a TLS handshake that omits the Server Key Exchange message and uses "particular cipher suites," which triggers a NULL pointer dereference.
- Record
DEBIAN-CVE-2008-1672- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:11125-1 No score
libopenssl-devel-1.1.1l-1.2 on GA media
These are all security issues fixed in the libopenssl-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11125-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11126-1 No score
libopenssl-1_0_0-devel-1.0.2u-6.2 on GA media
These are all security issues fixed in the libopenssl-1_0_0-devel-1.0.2u-6.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11126-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score
libopenssl-1_1-devel-1.1.1l-1.2 on GA media
These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11127-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslDebian:12 |
before 0.9.8g-10.1 | 0.9.8g-10.1 |
opensslDebian:13 |
before 0.9.8g-10.1 | 0.9.8g-10.1 |
opensslDebian:14 |
before 0.9.8g-10.1 | 0.9.8g-10.1 |
opensslDebian:5.0 From an advisory covering 2 CVEs |
before 0.9.8g-10+lenny1 | 0.9.8g-10+lenny1 |
openssl-1_0_0openSUSE:Tumbleweed From an advisory covering 29 CVEs |
before 1.0.2u-6.2 | 1.0.2u-6.2 |
openssl-1_1openSUSE:Tumbleweed From an advisory covering 136 CVEs |
before 1.1.1l-1.2 | 1.1.1l-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1672 is a medium vulnerability (CVSS 4.3) in Openssl, published May 29, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.00%, the 92nd percentile. Fixed in openssl 0.9.8g-10.1.
References
cert.fi/haavoittuvuudet/2008/advisory-openssl.html
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.562004
secunia.com/advisories/30852
redhat.com/archives/fedora-package-announce/2008-May/msg01029.html
exchange.xforce.ibmcloud.com/vulnerabilities/42667
support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=738400
Show 194 moreShow less
vupen.com/english/advisories/2008/1680
securityfocus.com/archive/1/492932/100/0/threaded
ubuntu.com/usn/usn-620-1
openssl.org/news/secadv_20080528.txt
security.gentoo.org/glsa/glsa-200806-08.xml
sourceforge.net/project/shownotes.php?release_id=615606
securitytracker.com/id?1020122
mandriva.com/security/advisories?name=MDVSA-2008:107
kb.cert.org/vuls/id/520586
nvd.nist.gov/vuln/detail/CVE-2008-1672
github.com/advisories/GHSA-322g-pxmj-97cc
security-tracker.debian.org/tracker/CVE-2008-1672
suse.com/support/update/announcement/-2022-445/suse-fu-20220445-1
bugzilla.suse.com/1000080
Left out here: 505 references. The JSON record has them.