CVE-2024-6119highCWE-843

CVE-2024-6119: fallo de gravedad alta en OpenSSL

Possible denial of service in X.509 name checks

Publicada el · Actualizada el

33Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 67%
probabilidad de explotación
67%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
Lo que declaran los fabricantes (VEX)

Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.

Afectado
6 productos (20 componentes)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 8 · Red Hat 3scale API Management Platform 2 · Red Hat OpenShift Container Platform 4 · y otros 1
workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Corregido
7 productos (111 componentes)
Red Hat Service Interconnect 1 · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat Enterprise Linux BaseOS (v. 9) · 9Base-Service-Interconnect-1.4 · Red Hat Enterprise Linux CRB (v. 9) · y otros 2
No afectado
5 productos (799 componentes) — porque el código vulnerable no está presente en el producto
Red Hat OpenShift Container Platform 4.16 · Red Hat OpenShift Container Platform 4.17 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat JBoss Core Services
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherName` subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program. Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address. TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
OpenSSL · OpenSSL