CVE-2016-8610 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote....
HighCVSS 7.5
EPSS 39.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssl(Debian:12) | < 1.0.2j-1 | 1.0.2j-1 |
| debian/openssl(Debian:13) | < 1.0.2j-1 | 1.0.2j-1 |
| debian/openssl(Debian:14) | < 1.0.2j-1 | 1.0.2j-1 |
| OpenSSL | >= 1.0.2, <= 1.0.2h | No fix listed |
| OpenSSL | = 0.9.8 | No fix listed |
| OpenSSL | = 1.0.1 | No fix listed |
| OpenSSL | = 1.1.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.0.0 | No fix listed |
| redhat jboss enterprise application platform | = 6.4.0 | No fix listed |
Show 59 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netapp cn1610 firmware | All versions | No fix listed |
| netapp clustered data ontap antivirus connector | All versions | No fix listed |
| netapp data ontap | All versions | No fix listed |
| netapp data ontap edge | All versions | No fix listed |
| netapp e-series santricity os controller | >= 11.0, <= 11.40 | No fix listed |
| netapp host agent | All versions | No fix listed |
| netapp oncommand balance | All versions | No fix listed |
| netapp oncommand unified manager | All versions | No fix listed |
| netapp oncommand workflow automation | All versions | No fix listed |
| netapp ontap select deploy | All versions | No fix listed |
| netapp service processor | All versions | No fix listed |
| netapp smi-s provider | All versions | No fix listed |
| netapp snapcenter server | All versions | No fix listed |
| netapp snapdrive | All versions | No fix listed |
| netapp StorageGRID | All versions | No fix listed |
| netapp storagegrid webscale | All versions | No fix listed |
| netapp clustered data ontap | All versions | No fix listed |
| paloaltonetworks pan-os | <= 6.1.17 | No fix listed |
| paloaltonetworks pan-os | >= 7.0.0, <= 7.0.15 | No fix listed |
| paloaltonetworks pan-os | >= 7.1.0, <= 7.1.10 | No fix listed |
| oracle adaptive access manager | = 11.1.2.3.0 | No fix listed |
| oracle application testing suite | = 13.3.0.1 | No fix listed |
| oracle communications analytics | = 12.1.1 | No fix listed |
| oracle communications ip service activator | = 7.3.4 | No fix listed |
| oracle communications ip service activator | = 7.4.0 | No fix listed |
| oracle core rdbms | = 11.2.0.4 | No fix listed |
| oracle core rdbms | = 12.1.0.2 | No fix listed |
| oracle core rdbms | = 12.2.0.1 | No fix listed |
| oracle core rdbms | = 18c | No fix listed |
| oracle core rdbms | = 19c | No fix listed |
| oracle enterprise manager ops center | = 12.3.3 | No fix listed |
| oracle enterprise manager ops center | = 12.4.0 | No fix listed |
| oracle goldengate application adapters | = 12.3.2.1.0 | No fix listed |
| oracle JD Edwards EnterpriseOne Tools | = 9.2 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.56 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.57 | No fix listed |
| oracle PeopleSoft Enterprise PeopleTools | = 8.58 | No fix listed |
| oracle retail predictive application server | = 15.0.3 | No fix listed |
| oracle retail predictive application server | = 16.0.3 | No fix listed |
| oracle timesten in-memory database | < 18.1.4.1.0 | 18.1.4.1.0 |
| oracle weblogic server | = 10.3.6.0.0 | No fix listed |
| oracle weblogic server | = 12.1.3.0.0 | No fix listed |
| oracle weblogic server | = 12.2.1.3.0 | No fix listed |
| oracle weblogic server | = 12.2.1.4.0 | No fix listed |
| fujitsu m10-1 firmware | < xcp2361 | xcp2361 |
| fujitsu m10-1 firmware | >= xcp3000, < xcp3070 | xcp3070 |
| fujitsu m10-4 firmware | < xcp2361 | xcp2361 |
| fujitsu m10-4 firmware | >= xcp3000, < xcp3070 | xcp3070 |
| fujitsu m10-4s firmware | < xcp2361 | xcp2361 |
| fujitsu m10-4s firmware | >= xcp3000, < xcp3070 | xcp3070 |
| fujitsu m12-1 firmware | < xcp2361 | xcp2361 |
| fujitsu m12-1 firmware | >= xcp3000, < xcp3070 | xcp3070 |
| fujitsu m12-2 firmware | < xcp2361 | xcp2361 |
| fujitsu m12-2 firmware | >= xcp3000, < xcp3070 | xcp3070 |
| fujitsu m12-2s firmware | < xcp2361 | xcp2361 |
| fujitsu m12-2s firmware | >= xcp3000, < xcp3070 | xcp3070 |
| OpenSSL | = All 0.9.8 | No fix listed |
| OpenSSL | = All 1.0.1 | No fix listed |
| OpenSSL | = 1.0.2 through 1.0.2h | No fix listed |
References
- Debian Security Tracker CVE-2016-8610 vendor-advisory
- RHSA-2017:0286 third-party-advisory vendor-advisory
- RHSA-2017:0574 third-party-advisory vendor-advisory
- RHSA-2017:1415 third-party-advisory vendor-advisory
- RHSA-2017:1659 third-party-advisory vendor-advisory
- [oss-security] 20161024 CVE-2016-8610: SSL Death Alert: OpenSSL SSL/TLS SSL3_AL_WARNING undefined alert Remote DoS mailing-list third-party-advisory
- 93841 third-party-advisory vdb-entry
- 1037084 third-party-advisory vdb-entry
- RHSA-2017:1413 third-party-advisory vendor-advisory
- RHSA-2017:1414 third-party-advisory vendor-advisory
- RHSA-2017:1658 third-party-advisory vendor-advisory
- RHSA-2017:1801 third-party-advisory vendor-advisory
- RHSA-2017:1802 third-party-advisory vendor-advisory
- RHSA-2017:2493 third-party-advisory vendor-advisory
- RHSA-2017:2494 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- git.openssl.org broken-link
- security.360.cn third-party-advisory
- FreeBSD-SA-16:35 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- security.paloaltonetworks.com third-party-advisory
- support.hpe.com third-party-advisory
- DSA-3773 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory