CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
AI Score
Confidence
High
A flaw was found in OpenSSL. Affected versions of this package are vulnerable to Information Exposure through the SSL_select_next_proto function. This flaw allows an attacker to cause unexpected application behavior or a crash by exploiting the buffer overread condition when the function is called with a zero-length client list. This issue is only exploitable if the application is misconfigured to use a zero-length server list and mishandles the ‘no overlap’ response in ALPN or uses the output as the opportunistic protocol in NPN.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
bugzilla.redhat.com/show_bug.cgi?id=2294581
github.com/openssl/openssl/commit/4ada436a1946cbb24db5ab4ca082b69c1bc10f37
github.com/openssl/openssl/commit/99fb785a5f85315b95288921a321a935ea29a51e
github.com/openssl/openssl/commit/cf6f91f6121f4db167405db2f0de410a456f260c
github.com/openssl/openssl/commit/e86ac436f0bd54d4517745483e2315650fae7b2c
github.openssl.org/openssl/extended-releases/commit/9947251413065a05189a63c9b7a6c1d4e224c21c
github.openssl.org/openssl/extended-releases/commit/b78ec0824da857223486660177d3b1f255c65d87
nvd.nist.gov/vuln/detail/CVE-2024-5535
www.cve.org/CVERecord?id=CVE-2024-5535
www.openssl.org/news/secadv/20240627.txt