CVE-2013-0166
OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 19.7%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 19.65% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- openssl/openssl · redhat/openssl
- Source
- secalert@redhat.com
References
- http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7
- http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=66e8211c0b1347970096e04b18aa52567c325200
- http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=ebc71865f0506a293242bd4aec97cdc7a8ef24b0
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00027.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00011.html
- http://marc.info/?l=bugtraq&m=136396549913849&w=2
- http://marc.info/?l=bugtraq&m=136432043316835&w=2
- http://marc.info/?l=bugtraq&m=137545771702053&w=2
- http://rhn.redhat.com/errata/RHSA-2013-0587.html
- http://rhn.redhat.com/errata/RHSA-2013-0782.html
- http://rhn.redhat.com/errata/RHSA-2013-0783.html
- http://rhn.redhat.com/errata/RHSA-2013-0833.html
- http://secunia.com/advisories/53623
- http://secunia.com/advisories/55108
- http://secunia.com/advisories/55139
- http://support.apple.com/kb/HT5880
- http://www.debian.org/security/2013/dsa-2621
- http://www.kb.cert.org/vuls/id/737740US Government Resource
- http://www.openssl.org/news/secadv_20130204.txtVendor Advisory
- http://www.splunk.com/view/SP-CAAAHXG
- https://bugzilla.redhat.com/show_bug.cgi?id=908052
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18754
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19081
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19360
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19487
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001
- http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7
- http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=66e8211c0b1347970096e04b18aa52567c325200
- http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=ebc71865f0506a293242bd4aec97cdc7a8ef24b0
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.