CVE-2016-6304: openssl 1.0.2h vulnerabilities

Published Sep 20, 2016
·
Updated

A malicious client can exhaust a server's memory, resulting in a denial of service (DoS) by sending very large OCSP Status Request extensions in a single session.

This flaw is labelled high severity due to the ease of use for a DoS attack and Node.js servers using TLS are vulnerable.

Other sources

A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.

Multiple memory leaks in t1lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

Quoting form the draft of the OpenSSL upstream advisory:

OCSP Status Request extension unbounded memory growth (CVE-2016-6304) =====================================================================

Severity: High

A malicious client can send an excessively large OCSP Status Request extension. If that client continually requests renegotiation, sending a large OCSP Status Request extension each time, then there will be unbounded memory growth on the server. This will eventually lead to a Denial Of Service attack through memory exhaustion. Servers with a default configuration are vulnerable even if they do not support OCSP. Builds using the "no-ocsp" build time option are not affected.

OpenSSL 1.1.0 users should upgrade to 1.1.0a OpenSSL 1.0.2 users should upgrade to 1.0.2i OpenSSL 1.0.1 users should upgrade to 1.0.1u

This issue was reported to OpenSSL on 29th August 2016 by Shi Lei (Gear Team, Qihoo 360 Inc.). The fix was developed by Matt Caswell of the OpenSSL development team.

— Red Hat

Affected Software

72 affected componentsFixes available
redhat/jbcs-httpd24-httpd<0:2.4.23-120.jbcs.el6
0:2.4.23-120.jbcs.el6
redhat/jbcs-httpd24-openssl<1:1.0.2h-13.jbcs.el6
1:1.0.2h-13.jbcs.el6
redhat/jbcs-httpd24-httpd<0:2.4.23-120.jbcs.el7
0:2.4.23-120.jbcs.el7
redhat/jbcs-httpd24-openssl<1:1.0.2h-13.jbcs.el7
1:1.0.2h-13.jbcs.el7
redhat/openssl<0:1.0.1e-48.el6_8.3
0:1.0.1e-48.el6_8.3
redhat/openssl<0:1.0.0-20.el6_2.9
0:1.0.0-20.el6_2.9
redhat/openssl<0:1.0.0-27.el6_4.6
0:1.0.0-27.el6_4.6
redhat/openssl<0:1.0.1e-16.el6_5.17
0:1.0.1e-16.el6_5.17
redhat/openssl<0:1.0.1e-30.el6_6.13
0:1.0.1e-30.el6_6.13
redhat/openssl<0:1.0.1e-42.el6_7.6
0:1.0.1e-42.el6_7.6
redhat/openssl<1:1.0.1e-51.el7_2.7
1:1.0.1e-51.el7_2.7
redhat/tomcat6<0:6.0.41-17_patch_04.ep6.el6
0:6.0.41-17_patch_04.ep6.el6
redhat/tomcat7<0:7.0.54-25_patch_05.ep6.el6
0:7.0.54-25_patch_05.ep6.el6
redhat/tomcat6<0:6.0.41-17_patch_04.ep6.el7
0:6.0.41-17_patch_04.ep6.el7
redhat/tomcat7<0:7.0.54-25_patch_05.ep6.el7
0:7.0.54-25_patch_05.ep6.el7
redhat/log4j-eap6<0:1.2.16-12.redhat_3.1.ep6.el6
0:1.2.16-12.redhat_3.1.ep6.el6
redhat/tomcat7<0:7.0.70-22.ep7.el6
0:7.0.70-22.ep7.el6
redhat/tomcat8<0:8.0.36-24.ep7.el6
0:8.0.36-24.ep7.el6
redhat/tomcat-native<0:1.2.8-10.redhat_10.ep7.el6
0:1.2.8-10.redhat_10.ep7.el6
redhat/log4j-eap6<0:1.2.16-12.redhat_3.1.ep6.el7
0:1.2.16-12.redhat_3.1.ep6.el7
redhat/tomcat7<0:7.0.70-22.ep7.el7
0:7.0.70-22.ep7.el7
redhat/tomcat8<0:8.0.36-24.ep7.el7
0:8.0.36-24.ep7.el7
redhat/tomcat-native<0:1.2.8-10.redhat_10.ep7.el7
0:1.2.8-10.redhat_10.ep7.el7
Advantech Spectre RT ERT351 firmware Versions 5.1.3 and prior
debian/openssl
1.1.1w-0+deb11u11.1.1w-0+deb11u23.0.15-1~deb12u13.0.14-1~deb12u23.5.0-1
OpenSSL OpenSSL=1.0.2
OpenSSL OpenSSL=1.0.2-beta1
OpenSSL OpenSSL=1.0.2-beta2
OpenSSL OpenSSL=1.0.2-beta3
OpenSSL OpenSSL=1.0.2a
OpenSSL OpenSSL=1.0.2b
OpenSSL OpenSSL=1.0.2c
OpenSSL OpenSSL=1.0.2d
OpenSSL OpenSSL=1.0.2e
OpenSSL OpenSSL=1.0.2f
OpenSSL OpenSSL=1.0.2h
OpenSSL OpenSSL=1.1.0
OpenSSL OpenSSL=1.0.1
OpenSSL OpenSSL=1.0.1-beta1
OpenSSL OpenSSL=1.0.1-beta2
OpenSSL OpenSSL=1.0.1-beta3
OpenSSL OpenSSL=1.0.1a
OpenSSL OpenSSL=1.0.1b
OpenSSL OpenSSL=1.0.1c
OpenSSL OpenSSL=1.0.1d
OpenSSL OpenSSL=1.0.1e
OpenSSL OpenSSL=1.0.1f
OpenSSL OpenSSL=1.0.1g
OpenSSL OpenSSL=1.0.1h
OpenSSL OpenSSL=1.0.1i
OpenSSL OpenSSL=1.0.1j
OpenSSL OpenSSL=1.0.1k
OpenSSL OpenSSL=1.0.1l
OpenSSL OpenSSL=1.0.1m
OpenSSL OpenSSL=1.0.1n
OpenSSL OpenSSL=1.0.1o
OpenSSL OpenSSL=1.0.1p
OpenSSL OpenSSL=1.0.1q
OpenSSL OpenSSL=1.0.1r
OpenSSL OpenSSL=1.0.1s
OpenSSL OpenSSL=1.0.1t
Nodejs Node.js>=0.10.0<0.10.47
Nodejs Node.js>=0.12.0<0.12.16
Nodejs Node.js>=4.0.0<4.6.0
Nodejs Node.js>=6.0.0<6.7.0
Novell Suse Linux Enterprise Module For Web Scripting=12.0
redhat/openssl<1.0.1
1.0.1
redhat/openssl<1.0.2
1.0.2
redhat/openssl<1.1.0
1.1.0
Node.js Node.js>=4.0.0<4.6.0, >=5.0.0<6.0.0, >=6.0.0<6.7.0
4.6.06.7.0
Node.js Node.js>=4.0.0<4.6.0
4.6.0
Node.js Node.js>=6.0.0<6.7.0
6.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.

    Fixed in 0:2.4.23-120.jbcs.el6
  2. Upgrade

    Upgrade redhat/jbcs-httpd24-openssl to a version that resolves this vulnerability.

    Fixed in 1:1.0.2h-13.jbcs.el6
  3. Upgrade

    Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.

    Fixed in 0:2.4.23-120.jbcs.el7
  4. Upgrade

    Upgrade redhat/jbcs-httpd24-openssl to a version that resolves this vulnerability.

    Fixed in 1:1.0.2h-13.jbcs.el7
  5. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 0:1.0.1e-48.el6_8.3
  6. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 0:1.0.0-20.el6_2.9
  7. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 0:1.0.0-27.el6_4.6
  8. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 0:1.0.1e-16.el6_5.17
  9. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 0:1.0.1e-30.el6_6.13
  10. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 0:1.0.1e-42.el6_7.6
  11. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 1:1.0.1e-51.el7_2.7
  12. Upgrade

    Upgrade redhat/tomcat6 to a version that resolves this vulnerability.

    Fixed in 0:6.0.41-17_patch_04.ep6.el6
  13. Upgrade

    Upgrade redhat/tomcat7 to a version that resolves this vulnerability.

    Fixed in 0:7.0.54-25_patch_05.ep6.el6
  14. Upgrade

    Upgrade redhat/tomcat6 to a version that resolves this vulnerability.

    Fixed in 0:6.0.41-17_patch_04.ep6.el7
  15. Upgrade

    Upgrade redhat/tomcat7 to a version that resolves this vulnerability.

    Fixed in 0:7.0.54-25_patch_05.ep6.el7
  16. Upgrade

    Upgrade redhat/log4j-eap6 to a version that resolves this vulnerability.

    Fixed in 0:1.2.16-12.redhat_3.1.ep6.el6
  17. Upgrade

    Upgrade redhat/tomcat7 to a version that resolves this vulnerability.

    Fixed in 0:7.0.70-22.ep7.el6
  18. Upgrade

    Upgrade redhat/tomcat8 to a version that resolves this vulnerability.

    Fixed in 0:8.0.36-24.ep7.el6
  19. Upgrade

    Upgrade redhat/tomcat-native to a version that resolves this vulnerability.

    Fixed in 0:1.2.8-10.redhat_10.ep7.el6
  20. Upgrade

    Upgrade redhat/log4j-eap6 to a version that resolves this vulnerability.

    Fixed in 0:1.2.16-12.redhat_3.1.ep6.el7
  21. Upgrade

    Upgrade redhat/tomcat7 to a version that resolves this vulnerability.

    Fixed in 0:7.0.70-22.ep7.el7
  22. Upgrade

    Upgrade redhat/tomcat8 to a version that resolves this vulnerability.

    Fixed in 0:8.0.36-24.ep7.el7
  23. Upgrade

    Upgrade redhat/tomcat-native to a version that resolves this vulnerability.

    Fixed in 0:1.2.8-10.redhat_10.ep7.el7
  24. Upgrade

    Upgrade debian/openssl to a version that resolves this vulnerability.

    Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u2Fixed in 3.0.15-1~deb12u1Fixed in 3.0.14-1~deb12u2Fixed in 3.5.0-1
  25. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 1.0.1
  26. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 1.0.2
  27. Upgrade

    Upgrade redhat/openssl to a version that resolves this vulnerability.

    Fixed in 1.1.0
  28. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.6.0Fixed in 6.7.0
  29. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 4.6.0
  30. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.7.0
  31. Upgrade

    Upgrade OpenSSL to a version that resolves this vulnerability.

    Fixed in 1.0.1u
  32. Upgrade

    Upgrade OpenSSL to a version that resolves this vulnerability.

    Fixed in 1.0.2i
  33. Upgrade

    Upgrade OpenSSL to a version that resolves this vulnerability.

    Fixed in 1.1.0a

Event History

Sep 20, 2016
Data Sourced
via Red Hat·08:10 AM
DescriptionSeverityAffected Software
Sep 22, 2016
CVE Published
12:00 AM
Sep 26, 2016
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Sep 28, 2016
Data Sourced
via Node.js·12:43 AM
Severity
Data Sourced
via Node.js·12:47 AM
Affected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2016-6304?

CVE-2016-6304 has a medium severity rating due to the potential for a memory leak that can be exploited by remote attackers.

2

How do I fix CVE-2016-6304?

To fix CVE-2016-6304, upgrade to the patched versions of OpenSSL or the affected software as specified in the latest security advisories.

3

Which software is affected by CVE-2016-6304?

CVE-2016-6304 affects multiple versions of OpenSSL and related packages in Red Hat's JBoss and Tomcat, among others.

4

What causes the vulnerability in CVE-2016-6304?

CVE-2016-6304 is caused by a memory leak in OpenSSL's handling of TLS status request extension data during session renegotiation.

5

Can CVE-2016-6304 lead to denial of service?

Yes, CVE-2016-6304 can lead to denial of service as it allows an attacker to exhaust server memory.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203