Code:  int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret)
 {
     int ok = 0;
    BIGNUM *q = NULL;
 
     *ret = 0;
    q = BN_new();
    if (q == NULL)
         goto err;
    BN_set_word(q, 1);
    if (BN_cmp(pub_key, q) <= 0)
         *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
    BN_copy(q, dh->p);
    BN_sub_word(q, 1);
    if (BN_cmp(pub_key, q) >= 0)
         *ret |= DH_CHECK_PUBKEY_TOO_LARGE;
 
     ok = 1;
  err:
    if (q != NULL)
        BN_free(q);
     return (ok);
 }

Vulnerability Type: +Info
CWE ID: CWE-200
Summary: The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple handshakes with a peer that chose an inappropriate number, as demonstrated by a number in an X9.42 file.
Commit Message: 