4.3

CVE-2013-4623

Exploit

The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate message that contains a PEM encoded certificate.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Polarssl ≫ Polarssl Version1.1.0
Polarssl ≫ Polarssl Version1.1.0 Updaterc0
Polarssl ≫ Polarssl Version1.1.0 Updaterc1
Polarssl ≫ Polarssl Version1.1.1
Polarssl ≫ Polarssl Version1.1.2
Polarssl ≫ Polarssl Version1.1.3
Polarssl ≫ Polarssl Version1.1.4
Polarssl ≫ Polarssl Version1.1.5
Polarssl ≫ Polarssl Version1.1.6
Polarssl ≫ Polarssl Version1.2.0
Polarssl ≫ Polarssl Version1.2.1
Polarssl ≫ Polarssl Version1.2.2
Polarssl ≫ Polarssl Version1.2.3
Polarssl ≫ Polarssl Version1.2.4
Polarssl ≫ Polarssl Version1.2.5
Polarssl ≫ Polarssl Version1.2.6
Polarssl ≫ Polarssl Version1.2.7
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.66% 0.687
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.