CVE-2015-1792

OpenSSL: CMS verify infinite loop with unknown hash function

Loading…

Severity

Moderate

Red Hat Product Security

4.3

CVSS 2.0

Review impact separately from score.

Published · June 11, 2015

Updated · August 5, 2026

Description

A denial of service flaw was found in the way OpenSSL verified certain signed messages using CMS (Cryptographic Message Syntax). A remote attacker could cause an application using OpenSSL to use excessive amounts of memory by sending a specially crafted message for verification.

Statement

This issue does NOT affect the version of OpenSSL package as shipped with Red Hat Enterprise Linux 5.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 2.0 · 4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P

CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')