Ubuntu.comUB:CVE-2023-24609CVE-2023-24609
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.0004 Low
EPSS
Percentile
12.6%
Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a
length-subtraction integer overflow for Client Hello Pre-Shared Key
extension parsing in the TLS 1.3 server. An attacked device calculates an
SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS
messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder
and tls13TranscriptHashUpdate.
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.0004 Low
EPSS
Percentile
12.6%