Improper input validation in OpenSSL - CVE-2017-3733
Published: February 16, 2017
Vulnerability identifier: #VU5839
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-3733
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause denial of service.
The vulnerability exists due to improper input validation during a renegotiation handshake, if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake. A remote attacker can send a specially crafted data to vulnerable application and case denial of service conditions.
Successful exploitation of the vulnerability may result in denial of service (DoS) attack.
Affected software
OpenSSL
How to mitigate CVE-2017-3733
Update to version 1.1.0e.