CVE-2016-7054 ChaCha20/Poly1305 heap-buffer-overflow

2017-05-0419:00:00

openssl

www.cve.org

AI Score

6.3

Confidence

High

EPSS

0.899

Percentile

98.9%

JSON

In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.

CNA Affected

[
  {
    "product": "OpenSSL",
    "vendor": "OpenSSL",
    "versions": [
      {
        "status": "affected",
        "version": "openssl-1.1.0"
      },
      {
        "status": "affected",
        "version": "openssl-1.1.0a"
      },
      {
        "status": "affected",
        "version": "openssl-1.1.0b"
      }
    ]
  }
]