Description

OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.

Remediation

References

CVE-2013-0166

Related Vulnerabilities

Oracle Database Server CVE-2006-0286 Vulnerability (CVE-2006-0286)

WordPress Plugin Pods-Custom Content Types and Fields SQL Injection (2.5.1.1)

Drupal Core 8.6.x Remote Code Execution (8.6.0 - 8.6.9)

Atlassian Jira Incorrect Authorization Vulnerability (CVE-2019-3401)

RubyGems Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') Vulnerability (CVE-2019-8321)

Severity

Medium

Classification

CVE-2013-0166

Tags

Missing Update Known Vulnerabilities