Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
Múltiples fugas de memoria en t1_lib.c en OpenSSL en versiones anteriores a 1.0.1u, 1.0.2 en versiones anteriores a 1.0.2i y 1.1.0 en versiones anteriores a 1.1.0a permiten a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de grandes extensiones OCSP Status Request
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:N/I:N/A:C
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | COMPLETE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-401
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| openssl | openssl | 1.0.2 | <built-in method update of dict object at 0x72a9cd06f340> | Application |
| openssl | openssl | 1.0.2 | <built-in method update of dict object at 0x72a9ccf9fd80> | Application |
| openssl | openssl | 1.0.2 | <built-in method update of dict object at 0x72a9b0907080> | Application |
| openssl | openssl | 1.0.2 | <built-in method update of dict object at 0x72a9cc434180> | Application |
| openssl | openssl | 1.0.2a | <built-in method update of dict object at 0x72a9cd06d900> | Application |
| openssl | openssl | 1.0.2b | <built-in method update of dict object at 0x72a9cd06dd80> | Application |
| openssl | openssl | 1.0.2c | <built-in method update of dict object at 0x72a9cd06d880> | Application |
| openssl | openssl | 1.0.2d | <built-in method update of dict object at 0x72a9ccd2b600> | Application |
| openssl | openssl | 1.0.2e | <built-in method update of dict object at 0x72a9ccd2a940> | Application |
| openssl | openssl | 1.0.2f | <built-in method update of dict object at 0x72a9cd06e540> | Application |
| openssl | openssl | 1.0.2h | <built-in method update of dict object at 0x72a9ccf9c7c0> | Application |
| openssl | openssl | 1.1.0 | <built-in method update of dict object at 0x72a9ccd2ae00> | Application |
| openssl | openssl | 1.0.1 | <built-in method update of dict object at 0x72a9b0b690c0> | Application |
| openssl | openssl | 1.0.1 | <built-in method update of dict object at 0x72a9cc6dbcc0> | Application |
| openssl | openssl | 1.0.1 | <built-in method update of dict object at 0x72a9ccf9fb00> | Application |
| openssl | openssl | 1.0.1 | <built-in method update of dict object at 0x72a9ccf9f200> | Application |
| openssl | openssl | 1.0.1a | <built-in method update of dict object at 0x72a9b0b39a00> | Application |
| openssl | openssl | 1.0.1b | <built-in method update of dict object at 0x72a9b0b68fc0> | Application |
| openssl | openssl | 1.0.1c | <built-in method update of dict object at 0x72a9b09063c0> | Application |
| openssl | openssl | 1.0.1d | <built-in method update of dict object at 0x72a9b0905b80> | Application |
| openssl | openssl | 1.0.1e | <built-in method update of dict object at 0x72a9cdf30bc0> | Application |
| openssl | openssl | 1.0.1f | <built-in method update of dict object at 0x72a9ccf9ec40> | Application |
| openssl | openssl | 1.0.1g | <built-in method update of dict object at 0x72a9cd06d840> | Application |
| openssl | openssl | 1.0.1h | <built-in method update of dict object at 0x72a9ccd29bc0> | Application |
| openssl | openssl | 1.0.1i | <built-in method update of dict object at 0x72a9b0b38840> | Application |
| openssl | openssl | 1.0.1j | <built-in method update of dict object at 0x72a9cc523e40> | Application |
| openssl | openssl | 1.0.1k | <built-in method update of dict object at 0x72a9b0b6acc0> | Application |
| openssl | openssl | 1.0.1l | <built-in method update of dict object at 0x72a9cc5de440> | Application |
| openssl | openssl | 1.0.1m | <built-in method update of dict object at 0x72a9ccf9f680> | Application |
| openssl | openssl | 1.0.1n | <built-in method update of dict object at 0x72a9b0c67880> | Application |
| openssl | openssl | 1.0.1o | <built-in method update of dict object at 0x72a9b0c67e40> | Application |
| openssl | openssl | 1.0.1p | <built-in method update of dict object at 0x72a9b0c64b80> | Application |
| openssl | openssl | 1.0.1q | <built-in method update of dict object at 0x72a9b0c64a80> | Application |
| openssl | openssl | 1.0.1r | <built-in method update of dict object at 0x72a9b0c65c40> | Application |
| openssl | openssl | 1.0.1s | <built-in method update of dict object at 0x72a9b0c65dc0> | Application |
| openssl | openssl | 1.0.1t | <built-in method update of dict object at 0x72a9b0c665c0> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9b0c67f80> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9b0c66280> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9b0c66100> | Application |
| nodejs | node.js | * | <built-in method update of dict object at 0x72a9b0c64c40> | Application |
| novell | suse_linux_enterprise_module_for_web_scripting | 12.0 | <built-in method update of dict object at 0x72a9b0c66e80> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1s:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:openssl:openssl:1.0.1t:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
| Yes | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:novell:suse_linux_enterprise_module_for_web_scripting:12.0:*:*:*:*:*:*:* |