Veracode Vulnerability DatabaseVERACODE:6024Denial Of Service (DoS)
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
OpenSSL is vulnerable to denial of service (DoS) attacks. A malicious user can pass a malicious string, causing the ASN.1 types with recursive definitions to exceed the stack and crash the application.
| CPE | Name | Operator | Version |
|---|---|---|---|
| openssl | le | 1.0.210 | |
| openssl-static | le | 1.0.2.c1 | |
| openssl-osx | le | 1.0.211 | |
| libssl.so | le | 1.0.2k |
References
www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
www.securityfocus.com/bid/103518
www.securityfocus.com/bid/105609
www.securitytracker.com/id/1040576
access.redhat.com/errata/RHSA-2018:3090
access.redhat.com/errata/RHSA-2018:3221
access.redhat.com/errata/RHSA-2018:3505
access.redhat.com/errata/RHSA-2019:0366
access.redhat.com/errata/RHSA-2019:0367
access.redhat.com/errata/RHSA-2019:1711
access.redhat.com/errata/RHSA-2019:1712
bugzilla.redhat.com/show_bug.cgi?id=1561269
git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33
git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9310d45087ae546e27e61ddf8f6367f29848220d
lists.debian.org/debian-lts-announce/2018/03/msg00033.html
nodejs.org/en/blog/vulnerability/march-2018-security-releases/
security.gentoo.org/glsa/201811-21
security.gentoo.org/glsa/202007-53
security.netapp.com/advisory/ntap-20180330-0002/
security.netapp.com/advisory/ntap-20180726-0002/
securityadvisories.paloaltonetworks.com/Home/Detail/133
usn.ubuntu.com/3611-1/
usn.ubuntu.com/3611-2/
www.debian.org/security/2018/dsa-4157
www.debian.org/security/2018/dsa-4158
www.openssl.org/news/secadv/20180327.txt
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
www.tenable.com/security/tns-2018-04
www.tenable.com/security/tns-2018-06
www.tenable.com/security/tns-2018-07
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P