OpenSSL fixes the HollowByte vulnerability

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] OpenSSL fixes the HollowByte vulnerability

OpenSSL fixes the HollowByte vulnerability, which allows an unauthenticated remote attacker to carry out a DoS attack on the target service by repeatedly sending specially crafted 11 B headers in the initial phase of a TLS request. On systems with the glibc library, the attacker can additionally cause persistent memory fragmentation. Detailed information about the vulnerability can be found at [1]. Fixed versions 4.0.1, 3.6.3, 3.5.7, 3.4.6 and 3.0.21 have been released for systems that take upstream packages. For stable and enterprise distributions, it is necessary to check in the package changelog whether the patch already implemented contains any of the pull requests 30792, 30793 or 30794 from the OpenSSL repository [1].

Report feedback

[TLP:CLEAR] OpenSSL fixes the HollowByte vulnerability

Links