4.3
CVE-2013-4623
- EPSS 1.89%
- Veröffentlicht 30.09.2013 22:55:04
- Zuletzt bearbeitet 29.04.2026 01:13:23
- Erkennungen
LoginThe x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate message that contains a PEM encoded certificate.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.89% | 0.768 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:N/A:P
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115922.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115927.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116351.html
http://www.debian.org/security/2013/dsa-2782
http://www.securityfocus.com/bid/61764
https://bugzilla.redhat.com/show_bug.cgi?id=997767
https://github.com/polarssl/polarssl/commit/1922a4e6aade7b1d685af19d4d9339ddb5c02859
https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03