4.3

CVE-2013-6449

The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.

Data is provided by the National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version <= 1.0.1e
OpenSSL ≫ OpenSSL Version1.0.0
OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta1
OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta2
OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta3
OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta4
OpenSSL ≫ OpenSSL Version1.0.0 Updatebeta5
OpenSSL ≫ OpenSSL Version1.0.0a
OpenSSL ≫ OpenSSL Version1.0.0b
OpenSSL ≫ OpenSSL Version1.0.0c
OpenSSL ≫ OpenSSL Version1.0.0d
OpenSSL ≫ OpenSSL Version1.0.0e
OpenSSL ≫ OpenSSL Version1.0.0f
OpenSSL ≫ OpenSSL Version1.0.0g
OpenSSL ≫ OpenSSL Version1.0.0h
OpenSSL ≫ OpenSSL Version1.0.0i
OpenSSL ≫ OpenSSL Version1.0.0j
OpenSSL ≫ OpenSSL Version1.0.1
OpenSSL ≫ OpenSSL Version1.0.1 Updatebeta1
OpenSSL ≫ OpenSSL Version1.0.1 Updatebeta2
OpenSSL ≫ OpenSSL Version1.0.1 Updatebeta3
OpenSSL ≫ OpenSSL Version1.0.1a
OpenSSL ≫ OpenSSL Version1.0.1b
OpenSSL ≫ OpenSSL Version1.0.1c
OpenSSL ≫ OpenSSL Version1.0.1d
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 56.01% 0.98
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:N/A:P