7.5

CVE-2016-2179

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
OpenSSL ≫ OpenSSL Version1.0.1
OpenSSL ≫ OpenSSL Version1.0.1a
OpenSSL ≫ OpenSSL Version1.0.1b
OpenSSL ≫ OpenSSL Version1.0.1c
OpenSSL ≫ OpenSSL Version1.0.1d
OpenSSL ≫ OpenSSL Version1.0.1e
OpenSSL ≫ OpenSSL Version1.0.1f
OpenSSL ≫ OpenSSL Version1.0.1g
OpenSSL ≫ OpenSSL Version1.0.1h
OpenSSL ≫ OpenSSL Version1.0.1i
OpenSSL ≫ OpenSSL Version1.0.1j
OpenSSL ≫ OpenSSL Version1.0.1k
OpenSSL ≫ OpenSSL Version1.0.1l
OpenSSL ≫ OpenSSL Version1.0.1m
OpenSSL ≫ OpenSSL Version1.0.1n
OpenSSL ≫ OpenSSL Version1.0.1o
OpenSSL ≫ OpenSSL Version1.0.1p
OpenSSL ≫ OpenSSL Version1.0.1q
OpenSSL ≫ OpenSSL Version1.0.1r
OpenSSL ≫ OpenSSL Version1.0.1s
OpenSSL ≫ OpenSSL Version1.0.1t
OpenSSL ≫ OpenSSL Version1.0.2
OpenSSL ≫ OpenSSL Version1.0.2a
OpenSSL ≫ OpenSSL Version1.0.2b
OpenSSL ≫ OpenSSL Version1.0.2c
OpenSSL ≫ OpenSSL Version1.0.2d
OpenSSL ≫ OpenSSL Version1.0.2e
OpenSSL ≫ OpenSSL Version1.0.2f
OpenSSL ≫ OpenSSL Version1.0.2g
OpenSSL ≫ OpenSSL Version1.0.2h
Oracle ≫ Linux Version6
Oracle ≫ Linux Version7
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 16.96% 0.947
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P