CVE-2016-6305: Input Validation
Published Sep 26, 2016
·Updated
The ssl3readbytes function in record/reclayers3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSLpeek call.
Affected Software
1 affected component
OpenSSL OpenSSL=1.1.0
Event History
Sep 26, 2016
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-6305?
CVE-2016-6305 has been classified as a high severity vulnerability due to its potential to cause a denial of service.
2
How do I fix CVE-2016-6305?
To mitigate CVE-2016-6305, users should upgrade OpenSSL to version 1.1.0a or later.
3
What type of attack does CVE-2016-6305 enable?
CVE-2016-6305 allows remote attackers to exploit the vulnerability to create an infinite loop, leading to a denial of service.
4
Which versions of OpenSSL are affected by CVE-2016-6305?
CVE-2016-6305 specifically affects OpenSSL version 1.1.0 before 1.1.0a.
5
What function in OpenSSL is responsible for the vulnerability CVE-2016-6305?
The vulnerability in CVE-2016-6305 is caused by the ssl3_read_bytes function in record/rec_layer_s3.c.