CVE-2022-1473

HIGH7.5EPSS 0.31%

Resource leakage when decoding certificates and keys

發布日:2022/5/4修改日:2023/11/8
也稱為:GHSA-g323-fr93-4j3cALPINE-CVE-2022-1473CGA-pg2g-c9hh-c6g2RUSTSEC-2022-0025

描述

The `OPENSSL_LH_flush()` function, which empties a hash table, contains a bug that breaks reuse of the memory occupied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication.

受影響套件(4)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1HIGH7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(10)