NetSight
IP …
high7.5

CVE-2016-6302

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows re…

Impact

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.

Affected products

VendorProductAffected versions
OpensslOpenssl
Versions 1.0.1, 1.0.1a, 1.0.1b, 1.0.1c, 1.0.1d, 1.0.1e
OracleLinux
Versions 6, 7
OracleSolaris
Versions 10, 11.3

Weakness classification

CWE-20

References