CVE-2016-8610

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

Affected products

Centos, Debian, Freebsd, Fujitsu M10-1, Fujitsu M10-4, Fujitsu M12-1, Fujitsu M12-2, Netapp Cn1610

Openssl

≤ 1.0.2h, 0.9.8, 1.0.1, 1.1.0

CVSS 3.1

7.5 HIGH

EPSS

39.7% (99th percentile)

Weakness

CWE-400

NVD status

Modified

Published

2017-11-13