[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

[3.4] openssl: Multiple issues (CVE-2016-2179, CVE-2016-2181, CVE-2016-2182, CVE-2016-6302, CVE-2016-6303)

ID: oval:org.secpod.oval:def:1800093Date: (C)2018-03-28   (M)2023-12-07
Class: PATCHFamily: unix




CVE-2016-2179: The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c. Reference: CVE-2016-2181: The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c. Reference: CVE-2016-2182: The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Reference: CVE-2016-6302: The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. Reference: CVE-2016-6303: The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short. Reference:

Platform:
Alpine Linux 3.4
Product:
openssl
Reference:
6177
CVE-2016-2179
CVE-2016-2181
CVE-2016-2182
CVE-2016-6302
CVE-2016-6303
CVE    5
CVE-2016-2179
CVE-2016-2181
CVE-2016-2182
CVE-2016-6303
...
CPE    28
cpe:/a:openssl:openssl
cpe:/a:openssl:openssl:1.0.2b
cpe:/a:openssl:openssl:1.0.2a
cpe:/a:openssl:openssl:1.0.2d
...

© SecPod Technologies