PT-2020-7860 · Openssl · Libressl

Pascal Cuoq · Published 2020-01-23 · Updated 2024-06-15 · CVE-2015-5333

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions: LibreSSL versions prior to 2.3.1

Description: The issue is related to a memory leak in the OBJ obj2txt function, which can be exploited by remote attackers to cause a denial of service through excessive memory consumption. This can be achieved by sending a large number of ASN.1 object identifiers in X.509 certificates.

Recommendations: For versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2015-5333

OPENSUSE-SU-2024:10309-1

Affected Products

Libressl

References · 36

• 🔥 http://packetstormsecurity.com/files/133998/Qualys-Security-Advisory-LibreSSL-Leak-Overflow.html · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:10309-1 · Vendor Advisory
• http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.3.1-relnotes.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5333 · Security Note
• http://lists.opensuse.org/opensuse-updates/2015-10/msg00050.html · Note
• https://suse.com/security/cve/CVE-2015-1788 · Note
• https://suse.com/security/cve/CVE-2014-8176 · Note
• https://suse.com/security/cve/CVE-2014-3511 · Note
• https://suse.com/security/cve/CVE-2014-3510 · Note
• https://suse.com/security/cve/CVE-2014-5139 · Note
• https://suse.com/security/cve/CVE-2014-3508 · Note
• https://suse.com/security/cve/CVE-2014-3506 · Note
• https://suse.com/security/cve/CVE-2015-0287 · Note
• https://suse.com/security/cve/CVE-2015-0286 · Note
• https://suse.com/security/cve/CVE-2015-0206 · Note