CVE-2011-1473

medium · 5

OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment

CVSS

67.2%

EPSS (exploit prob.)

99th

EPSS percentile

2012-06-16

Published

AV:N/AC:L/Au:N/C:N/I:N/A:P

Weaknesses

CWE-264

Affected products

Vendor	Product	Affected versions
openssl	openssl	0.9.8m
openssl	openssl	0.9.8m
openssl	openssl	0.9.8n
openssl	openssl	0.9.8o
openssl	openssl	0.9.8p
openssl	openssl	0.9.8r
openssl	openssl	0.9.8s
openssl	openssl	0.9.8t
openssl	openssl	0.9.8u
openssl	openssl	0.9.8v
openssl	openssl	0.9.8w
openssl	openssl	0.9.8x
openssl	openssl	<= 0.9.8k

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2011-1473