CVE-2016-8610
Publication date 24 October 2016
Last updated 24 July 2024
Ubuntu priority
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| gnutls26 | ||
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty |
Fixed 2.12.23-12ubuntu2.6
|
|
| gnutls28 | ||
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Fixed 3.4.10-4ubuntu1.2
|
|
| 14.04 LTS trusty | Not in release | |
| openssl | ||
| 18.04 LTS bionic |
Fixed 1.0.2g-1ubuntu11
|
|
| 16.04 LTS xenial |
Fixed 1.0.2g-1ubuntu4.6
|
|
| 14.04 LTS trusty |
Fixed 1.0.1f-1ubuntu2.22
|
|
| openssl098 | ||
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release | |
Patch details
| Package | Patch details |
|---|---|
| gnutls28 | |
| openssl |
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-3183-1
- GnuTLS vulnerabilities
- 1 February 2017
- USN-3183-2
- GnuTLS vulnerability
- 20 March 2017
- USN-3181-1
- OpenSSL vulnerabilities
- 31 January 2017