Vulnerability in Openssl
CVE-2008-1678
Memory leak in the zlib_stateful_init function in crypto/comp/c_zlib.c in libssl in OpenSSL 0.9.8f through 0.9.8h allows remote attackers to cause a denial of service (memory consumption) via multiple calls, as demonstrated by initial SSL client handshakes to the Apache HTTP Server mod_ssl that specify a compression algorithm.
EPSS: 0.053 (91.7th percentile) — read the EPSS interpretation.
Affected products
- Openssl — versions 0.9.8f, 0.9.8g, 0.9.8h
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
- secalert@redhat.com (x_refsource_SECUNIA, third-party-advisory)
- secalert@redhat.com (vdb-entry, x_refsource_XF)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_SLACKWARE)
- secalert@redhat.com (vdb-entry, x_refsource_BID)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
- secalert@redhat.com (signature, x_refsource_OVAL, vdb-entry)
Frequently asked questions
- What is CVE-2008-1678?
- CVE-2008-1678 is a vulnerability in Openssl, classified under CWE-399. Published 2008-07-10.
- Is CVE-2008-1678 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.