CVE-2011-1473
Last modified
CVE-2011-1473 is a vulnerability of currently unknown severity. OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment. EPSS estimates a 67.70% chance of exploitation in the next 30 days.
Description
OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openssl | Openssl | 0.9.8m |
| Openssl | Openssl | 0.9.8n |
| Openssl | Openssl | 0.9.8o |
| Openssl | Openssl | 0.9.8p |
| Openssl | Openssl | 0.9.8r |
| Openssl | Openssl | 0.9.8s |
| Openssl | Openssl | 0.9.8t |
| Openssl | Openssl | 0.9.8u |
| Openssl | Openssl | 0.9.8v |
| Openssl | Openssl | 0.9.8w |
| Openssl | Openssl | 0.9.8x |
| Openssl | Openssl | <= 0.9.8k |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2011-1473?
How severe is CVE-2011-1473?
How do I fix CVE-2011-1473?
Are you affected by CVE-2011-1473?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST