Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openssl | Openssl | 1.0.2b (including) | 1.0.2n (including) |
| Openssl | Openssl | 1.1.0 (including) | 1.1.0g (including) |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-0:1-6.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-apache-commons-daemon-jsvc-1:1.1.0-3.redhat_2.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-apr-0:1.6.3-31.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-apr-util-0:1.6.1-24.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-httpd-0:2.4.29-35.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_cluster-native-0:1.3.8-3.Final_redhat_2.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_jk-0:1.2.46-1.redhat_1.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-nghttp2-0:1.29.0-9.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-openssl-1:1.0.2n-14.jbcs.el6 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-0:1-6.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-apache-commons-daemon-jsvc-1:1.1.0-3.redhat_2.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-apr-0:1.6.3-31.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-apr-util-0:1.6.1-24.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-httpd-0:2.4.29-35.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_cluster-native-0:1.3.8-3.Final_redhat_2.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_jk-0:1.2.46-1.redhat_1.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-nghttp2-0:1.29.0-9.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-openssl-1:1.0.2n-14.jbcs.el7 | * |
| Red Hat Enterprise Linux 7 | RedHat | ovmf-0:20180508-3.gitee3198e672e2.el7 | * |
| Red Hat Enterprise Linux 7 | RedHat | openssl-1:1.0.2k-16.el7 | * |
| Red Hat JBoss Core Services 1 | RedHat | openssl | * |
| Red Hat JBoss Web Server 3.1 | RedHat | openssl | * |
| Red Hat JBoss Web Server 3 for RHEL 6 | RedHat | tomcat7-0:7.0.70-34.ep7.el6 | * |
| Red Hat JBoss Web Server 3 for RHEL 6 | RedHat | tomcat8-0:8.0.36-39.ep7.el6 | * |
| Red Hat JBoss Web Server 3 for RHEL 6 | RedHat | tomcat-native-0:1.2.17-19.redhat_19.ep7.el6 | * |
| Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | tomcat7-0:7.0.70-34.ep7.el7 | * |
| Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | tomcat8-0:8.0.36-39.ep7.el7 | * |
| Red Hat JBoss Web Server 3 for RHEL 7 | RedHat | tomcat-native-0:1.2.17-19.redhat_19.ep7.el7 | * |
| Openssl | Ubuntu | artful | * |
| Openssl | Ubuntu | bionic | * |
| Openssl | Ubuntu | cosmic | * |
| Openssl | Ubuntu | devel | * |
| Openssl | Ubuntu | disco | * |
| Openssl | Ubuntu | trusty | * |
| Openssl | Ubuntu | upstream | * |
| Openssl | Ubuntu | xenial | * |
| Openssl098 | Ubuntu | trusty | * |
| Openssl1.0 | Ubuntu | bionic | * |
| Openssl1.0 | Ubuntu | cosmic | * |