REDHAT-BUG-997767: Medium severity polarssl vulnerability
From the PolarSSL Security Advisory 2013-03 advisory:
"A bug in the logic of the parsing of PEM encoded certificates in x509parsecrt() can result in an infinite loop, thus hogging processing power."
A remote attacker could use this flaw to make a TLS/SSL server using PolarSSL consume an excessive amount of CPU.
This issue was corrected in PolarSSL versions 1.1.7 and 1.2.8. (Versions prior to these are affected.)
External References:
https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-997767?
The severity of REDHAT-BUG-997767 is considered high due to the potential for an infinite loop that can consume excessive processing power.
How do I fix REDHAT-BUG-997767?
To fix REDHAT-BUG-997767, update PolarSSL to a version later than 1.2.8.
Who is affected by REDHAT-BUG-997767?
All users of PolarSSL versions up to 1.2.8 are affected by REDHAT-BUG-997767.
Can REDHAT-BUG-997767 be exploited remotely?
Yes, a remote attacker can exploit REDHAT-BUG-997767 to cause denial of service on a TLS/SSL server.
What products are vulnerable due to REDHAT-BUG-997767?
The products vulnerable due to REDHAT-BUG-997767 are the PolarSSL libraries below version 1.2.8.