CVE-2016-6302

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows…

published September 16, 2016

CVSS
—
EPSS
28%
Percentile
98.1
In the wild
Unconfirmed
What it is

The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.27806 · 98.1th percentile
Published
2016-09-16T00:00Z
EPSS history
Timeline
  • 16 SEP 00:00Z
    The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows…
    cvelistv5