CVE-2016-8610
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
- Score
- CVSS 3.1 7.5 High
- Status
- Modified - secalert@redhat.com
- Published
- 2017-11-13
- Last modified
- 2024-08-06
- Weaknesses
- CWE-400
Affected products
- Debian Linux (Debian)
- M10-1 Firmware (Fujitsu)
- M10-4 Firmware (Fujitsu)
- M10-4s Firmware (Fujitsu)
- M12-1 Firmware (Fujitsu)
- M12-2 Firmware (Fujitsu)
- M12-2s Firmware (Fujitsu)
- Clustered Data Ontap (Netapp)
- Clustered Data Ontap Antivirus Connector (Netapp)
- Cn1610 Firmware (Netapp)
- Data Ontap (Netapp)
- Data Ontap Edge (Netapp)
- E-series Santricity Os Controller (Netapp)
- Host Agent (Netapp)
- Oncommand Balance (Netapp)
- Oncommand Unified Manager (Netapp)
- Oncommand Workflow Automation (Netapp)
- Ontap Select Deploy (Netapp)
- Service Processor (Netapp)
- Smi-s Provider (Netapp)
- Snapcenter Server (Netapp)
- Snapdrive (Netapp)
- Storagegrid (Netapp)
- Storagegrid Webscale (Netapp)
- Openssl (Openssl)
- Adaptive Access Manager (Oracle)
- Application Testing Suite (Oracle)
- Communications Analytics (Oracle)
- Communications Ip Service Activator (Oracle)
- Core Rdbms (Oracle)
- Enterprise Manager Ops Center (Oracle)
- Goldengate Application Adapters (Oracle)
- Jd Edwards Enterpriseone Tools (Oracle)
- Peoplesoft Enterprise Peopletools (Oracle)
- Retail Predictive Application Server (Oracle)
- Timesten In-memory Database (Oracle)
- Weblogic Server (Oracle)
- Pan-os (Paloaltonetworks)
- Enterprise Linux Desktop (Redhat)
- Enterprise Linux Server (Redhat)
- Enterprise Linux Server Aus (Redhat)
- Enterprise Linux Server Eus (Redhat)
- Enterprise Linux Server Tus (Redhat)
- Enterprise Linux Workstation (Redhat)
- Jboss Enterprise Application Platform (Redhat)
References
- http://rhn.redhat.com/errata/RHSA-2017-0286.html
- http://rhn.redhat.com/errata/RHSA-2017-0574.html
- http://rhn.redhat.com/errata/RHSA-2017-1415.html
- http://rhn.redhat.com/errata/RHSA-2017-1659.html
- http://seclists.org/oss-sec/2016/q4/224
- http://www.securityfocus.com/bid/93841
- http://www.securitytracker.com/id/1037084
- https://access.redhat.com/errata/RHSA-2017:1413
- https://access.redhat.com/errata/RHSA-2017:1414
- https://access.redhat.com/errata/RHSA-2017:1658
- https://access.redhat.com/errata/RHSA-2017:1801
- https://access.redhat.com/errata/RHSA-2017:1802
- https://access.redhat.com/errata/RHSA-2017:2493
- https://access.redhat.com/errata/RHSA-2017:2494
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401
- https://security.360.cn/cve/CVE-2016-8610/
- https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc
- https://security.netapp.com/advisory/ntap-20171130-0001/
- https://security.paloaltonetworks.com/CVE-2016-8610
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us
- https://www.debian.org/security/2017/dsa-3773
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
