OpenSSL
OpenSSL 1.0.0
OpenSSL 1.0.0
The OpenSSL 1.0.0 reached end of service life on Dec 31, 2015. Third-party maintenance keeps it supported — 24/7 engineering support and same-day replacement parts — at 40-70% below OEM renewal pricing.
End of Service LifeEOSL Date: Dec 31, 2015
Specifications
- product
- openssl
- release
- 1.0.0
- product Label
- OpenSSL
- release Label
- 1.0.0
- codename
- lts
- latest Version
- 1.0.0t
- release Date
- 2010-03-29
- maintained
- source Url
- https://endoflife.date/openssl
Lifecycle Dates
- End of Service Life
- Dec 31, 2015
- Last OEM Support
- Dec 31, 2015
OEM vs. 3rd Party Support
See how 3rd party maintenance compares to traditional OEM support for your OpenSSL 1.0.0. Get the same level of service at a fraction of the cost.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| 24/7/365 Support | ||
| Same-Day Parts Replacement | Limited | |
| Mixed-Vendor Support | ||
| Flexible Contract Terms | Annual Only | Month-to-Month Available |
| Asset Lifecycle Extension | ||
| OEM-Trained Engineers |
Why Choose 3rd Party Support for OpenSSL 1.0.0?
Save 40-70%
Dramatically reduce your maintenance costs while maintaining the same level of support coverage.
Extend Asset Life
Continue using your OpenSSL 1.0.0 well beyond the OEM end-of-life date.
24/7 Expert Support
OEM-trained engineers available around the clock with same-day parts replacement.
OpenSSL 1.0.0 Support: Frequently Asked Questions
Is the OpenSSL 1.0.0 still supported?
OpenSSL ended support for the OpenSSL 1.0.0 on Dec 31, 2015. Third-party maintenance remains available and keeps the OpenSSL 1.0.0 supported with 24/7 engineering support and same-day replacement parts.
When is the OpenSSL 1.0.0 end of service life (EOSL) date?
OpenSSL lists the end of service life for the OpenSSL 1.0.0 as Dec 31, 2015.
Can I keep using the OpenSSL 1.0.0 after its EOSL date?
Yes. EOSL means OpenSSL stops selling support contracts and issuing updates — the equipment itself keeps working. Third-party maintenance provides engineering support and replacement parts for as long as you choose to run it.
How much does third-party support for the OpenSSL 1.0.0 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting OpenSSL 1.0.0
62 published CVEs affect the OpenSSL 1.0.0, including 14 rated critical or high severity. OpenSSL no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2016-2108 | CRITICAL | 9.8 | May 5, 2016 | The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. |
| CVE-2016-2176 | HIGH | 8.2 | May 5, 2016 | The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data. |
| CVE-2010-3864 | HIGH | 7.6 | Nov 17, 2010 | Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography. |
| CVE-2021-4044 | HIGH | 7.5 | Dec 14, 2021 | Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only sup |
| CVE-2016-2109 | HIGH | 7.5 | May 5, 2016 | The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding. |
| CVE-2016-2106 | HIGH | 7.5 | May 5, 2016 | Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data. |
| CVE-2015-1789 | HIGH | 7.5 | Jun 12, 2015 | The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted length field in ASN1_TIME data, as demonstrated by an attack against a server that supports client authentication with a custom verification callback. |
| CVE-2014-8176 | HIGH | 7.5 | Jun 12, 2015 | The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data. |
| CVE-2015-0292 | HIGH | 7.5 | Mar 19, 2015 | Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted base64 data that triggers a buffer overflow. |
| CVE-2014-3512 | HIGH | 7.5 | Aug 13, 2014 | Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter. |
| CVE-2012-2110 | HIGH | 7.5 | Apr 19, 2012 | The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key. |
| CVE-2010-4252 | HIGH | 7.5 | Dec 6, 2010 | OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol. |
| CVE-2010-0742 | HIGH | 7.5 | Jun 3, 2010 | The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors. |
| CVE-2014-3567 | HIGH | 7.1 | Oct 19, 2014 | Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure. |
| CVE-2015-1791 | MEDIUM | 6.8 | Jun 12, 2015 | Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact by providing a NewSessionTicket during an attempt to reuse a ticket that had been obtained earlier. |
| CVE-2015-0209 | MEDIUM | 6.8 | Mar 19, 2015 | Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a malformed Elliptic Curve (EC) private-key file that is improperly handled during import. |
| CVE-2014-3509 | MEDIUM | 6.8 | Aug 13, 2014 | Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data. |
| CVE-2012-2333 | MEDIUM | 6.8 | May 14, 2012 | Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation. |
| CVE-2010-1633 | MEDIUM | 6.4 | Jun 3, 2010 | RSA verification recovery in the EVP_PKEY_verify_recover function in OpenSSL 1.x before 1.0.0a, as used by pkeyutl and possibly other applications, returns uninitialized memory upon failure, which might allow context-dependent attackers to bypass intended key requirements or obtain sensitive information via unspecified vectors. NOTE: some of these details are obtained from third party information. |
| CVE-2016-2107 | MEDIUM | 5.9 | May 5, 2016 | The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169. |
Showing the 20 most severe of 62 known CVEs.
Get Third Party SupportRelated OpenSSL Products
All OpenSSL products →OpenSSL 1.0.0
Save 40-70% vs OEM