CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.9 are vulnerable due to improper validation of the memory_cost parameter in identity file protection blocks, which can lead to out-of-memory conditions during key derivation. This vulnerability allows attackers with write access to local identity stores to create malicious identity files that can crash the host system when attempting to unlock identities. Organizations using affected versions of OpenSSL should prioritize patching to mitigate potential denial-of-service risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt before 1.4.9 fails to validate the memory_cost parameter from identity file protection blocks, allowing attackers to trigger out-of-memory conditions during key derivation. Attackers with write access to local identity stores can craft malicious identity files with excessive memory_cost values that cause the host to crash when unlocking identities before authentication.
Related CVEs
Other vulnerabilities affecting the same vendor(s)