OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| F5 Big Ip | — | — | Feb 16, 2017 | Jun 16, 2012 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Mar 5, 2026 | Jun 16, 2012 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | Jun 16, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 13, 2011 |
| Suse | — | Upgrade lighttpd-mod_trigger_b4_dlUpgrade lighttpdUpgrade lighttpd-mod_rrdtoolUpgrade lighttpd-mod_mysql_vhostUpgrade lighttpd-mod_webdavUpgrade lighttpd-mod_cmlUpgrade lighttpd-mod_magnet | Dec 12, 2013 | Sep 1, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub