CVE Vulnerabilities

CVE-2024-41996

Improper Certificate Validation

Published: Aug 26, 2024 | Modified: Aug 26, 2024
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
5.9 LOW
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu
LOW

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.

Weakness

The product does not validate, or incorrectly validates, a certificate.

Affected Software

Name Vendor Start Version End Version
Openssl Ubuntu devel *
Openssl Ubuntu fips-preview/jammy *
Openssl Ubuntu fips-updates/jammy *
Openssl Ubuntu jammy *
Openssl Ubuntu noble *
Openssl Ubuntu oracular *

Potential Mitigations

References