CVE-2011-1473

Published 16 Jun 2012 · Updated 06 Aug 2024

15Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 67%

exploitation probability

67%top 1% of all CVEs

observed exploitation

nono source reports it

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Affected

3 products (11 components)

Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 4 · Red Hat Enterprise Linux 5

no_fix_planned: Will not fix

OpenSSL before 0.9.8l, and 0.9.8m through 1.x, does not properly restrict client-initiated renegotiation within the SSL and TLS protocols, which might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection, a different vulnerability than CVE-2011-5094. NOTE: it can also be argued that it is the responsibility of server deployments, not a security library, to prevent or limit renegotiation when it is inappropriate within a specific environment

Affected products

n/a · n/a

References