CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.0 are vulnerable due to an ineffective in-memory rate limiter for TOTP brute-force protection, which is not shared across worker instances and resets upon server restart. This flaw allows attackers to circumvent rate limiting by distributing authentication attempts across multiple server instances or by retrying immediately after a restart, potentially leading to unauthorized access. Organizations using affected versions of OpenSSL should prioritize patching to mitigate the risk of brute-force attacks on their authentication mechanisms.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections.
Related CVEs
Other vulnerabilities affecting the same vendor(s)