Joseph Birr-Pixton

The issue is related to the OpenSSL API function `SSL select next proto` which can cause a crash or memory contents to be sent to the peer when called with an empty supported client protocols buffer. This can result in a loss of confidentiality, with up to 255 bytes of arbitrary private data from memory being sent to the peer. The issue is typically not under attacker control and may occur by accident due to a configuration or programming error in the calling application. The `SSL select next proto` function is used by TLS applications that support ALPN (Application Layer Protocol Negotiation) or NPN (Next Protocol Negotiation), with NPN being older and deprecated in favor of ALPN.

The issue is related to the BN GF2m mod inv function in OpenSSL, which does not properly handle ECParameters structures in which the curve is over a malformed binary polynomial field. This allows remote attackers to cause a denial of service (infinite loop) via a session that uses an Elliptic Curve algorithm. The vulnerability is associated with resource management errors and can be exploited by a remote attacker to cause a denial of service due to errors that occur during the establishment of a session that uses an Elliptic Curve-based algorithm.