CVE-2016-7054: ChaCha20/Poly1305 heap-buffer-overflow
Published May 4, 2017
·Updated
In OpenSSL 1.1.0 before 1.1.0c, TLS connections using -CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger payloads. This can result in an OpenSSL crash. This issue is not considered to be exploitable beyond a DoS.
Affected Software
3 affected components
OpenSSL OpenSSL=1.1.0
OpenSSL OpenSSL=1.1.0a
OpenSSL OpenSSL=1.1.0b
Remediation
Patch Available
Event History
May 4, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2016-7054?
CVE-2016-7054 is classified as a denial of service vulnerability.
2
How do I fix CVE-2016-7054?
To mitigate CVE-2016-7054, upgrade OpenSSL to version 1.1.0c or later.
3
What impact does CVE-2016-7054 have on affected software?
CVE-2016-7054 can cause affected OpenSSL versions to crash during TLS connections with certain ciphersuites.
4
Which versions of OpenSSL are affected by CVE-2016-7054?
CVE-2016-7054 affects OpenSSL versions 1.1.0 through 1.1.0b.
5
Is CVE-2016-7054 remotely exploitable?
CVE-2016-7054 is not considered exploitable beyond causing a denial of service.