|Description||The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.|
|Source||CVE (at NVD; LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)|
|NVD severity||low (attack range: remote)|
Vulnerable and fixed packages
The table below lists information on source packages.
|openssl (PTS)||wheezy, wheezy (security)||1.0.1e-2+deb7u20||fixed|
|jessie, jessie (security)||1.0.1k-3+deb8u4||fixed|
The information below is based on the following data on fixed versions.