← Voltar para CVEs

CVE-2013-4623

N/A

Descricao

The x509parse_crt function in x509.h in PolarSSL 1.1.x before 1.1.7 and 1.2.x before 1.2.8 does not properly parse certificate messages during the SSL/TLS handshake, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certificate message that contains a PEM encoded certificate.

Detalhes CVE

Pontuacao CVSS v3.1N/A

Publicado9/30/2013

Ultima modificacao4/11/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

polarssl:polarssl

Fraquezas (CWE)

CWE-20

Referencias

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115922.html(cve@mitre.org)

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115927.html(cve@mitre.org)

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116351.html(cve@mitre.org)

http://www.debian.org/security/2013/dsa-2782(cve@mitre.org)

http://www.securityfocus.com/bid/61764(cve@mitre.org)

https://bugzilla.redhat.com/show_bug.cgi?id=997767(cve@mitre.org)

https://github.com/polarssl/polarssl/commit/1922a4e6aade7b1d685af19d4d9339ddb5c02859(cve@mitre.org)

https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03(cve@mitre.org)

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115922.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115927.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116351.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2013/dsa-2782(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/61764(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=997767(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/polarssl/polarssl/commit/1922a4e6aade7b1d685af19d4d9339ddb5c02859(af854a3a-2127-422b-91ae-364da2661108)

https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2013-03(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.