Rapid7

vulnerability

CentOS: (CVE-2016-2179) CESA-2016:1940: openssl

Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Published
Sep 16, 2016
Added
Oct 21, 2016
Modified
May 5, 2019

Description

The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.

Solutions

centos-upgrade-opensslcentos-upgrade-openssl-develcentos-upgrade-openssl-libscentos-upgrade-openssl-perlcentos-upgrade-openssl-static
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.