CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.9 are vulnerable due to inadequate validation of key derivation function (KDF) cost parameters in encrypted file metadata and keystore headers. This flaw enables attackers to create malicious encrypted files that specify excessively large KDF parameters, potentially leading to unbounded memory allocation, system crashes, and denial of service without requiring authentication. Organizations using affected versions of OpenSSL should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.
Related CVEs
Other vulnerabilities affecting the same vendor(s)