Code: static const SSL_METHOD *ssl23_get_client_method(int ver)
	{
#ifndef OPENSSL_NO_SSL2
        if (ver == SSL2_VERSION)
                return(SSLv2_client_method());
 #endif
        if (ver == SSL3_VERSION)
                return(SSLv3_client_method());
       else if (ver == TLS1_VERSION)
                return(TLSv1_client_method());
        else if (ver == TLS1_1_VERSION)
                return(TLSv1_1_client_method());
	else
		return(NULL);
	}

Vulnerability Type: Bypass
CWE ID: CWE-310
Summary: OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.
Commit Message: 