CVE-2016-8610: High severity OpenSSL OpenSSL vulnerability
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Other sources
A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
A flaw was found in the way OpenSSL processed ALERT packets during an SSL handshake. A attacker basically sends a large number of plaintext WARNING pkgs after CLIENTHELLO, which causes OpenSSL to go into a endless loop (while the attacker keeps on sending more alert packets), consequently taking 100% CPU. This may cause certain applications compiled against OpenSSL to hang and may not be able to serve content to the clients. This is specially true about for servers which do not for or allocate extra thread for the processing of ClientHello like nginx.
This is fixed in OpenSSL upstream commit via:
https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=af58be768ebb690f78530f796e92b8ae5c9a4401
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-8610?
CVE-2016-8610 is classified as a denial of service vulnerability that can lead to excessive CPU consumption on affected OpenSSL servers.
How do I fix CVE-2016-8610?
To fix CVE-2016-8610, update OpenSSL to a version higher than 1.0.2h or apply patches provided by your Linux distribution.
Which versions of OpenSSL are affected by CVE-2016-8610?
CVE-2016-8610 affects OpenSSL versions 0.9.8, 1.0.1, and 1.0.2 through 1.0.2h, as well as 1.1.0.
Can CVE-2016-8610 be exploited remotely?
Yes, an attacker can remotely exploit CVE-2016-8610 via crafted ALERT packets during a TLS/SSL handshake.
What should I do if I cannot update OpenSSL immediately for CVE-2016-8610?
If immediate updates are not possible for CVE-2016-8610, consider implementing network measures to filter or block malicious traffic that exploits this vulnerability.