CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.9 are vulnerable due to improper validation of key derivation function (KDF) costs, which can be exploited by attackers using specially crafted files. This vulnerability allows for unbounded memory and CPU exhaustion during pre-authentication, potentially leading to system crashes or process hang-ups before password verification. Organizations utilizing affected OpenSSL versions should prioritize patching to mitigate the risk of denial-of-service attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Attackers can supply malicious files with excessive KDF parameters to exhaust system resources and crash or wedge the process before password verification occurs.
Related CVEs
Other vulnerabilities affecting the same vendor(s)