Homepage
About Snyk

Incomplete Cleanup Affecting openssl package, versions <1.0.2g-1ubuntu4.20+esm3

low

Snyk CVSS

    Attack Complexity Low
    Availability High

    Threat Intelligence

    EPSS 0.29% (69th percentile)
Expand this section
NVD
7.5 high
Expand this section
SUSE
7.5 high
Expand this section
Red Hat
7.5 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-UBUNTU1604-OPENSSL-2807704
  • published 4 May 2022
  • disclosed 3 May 2022
Report a new vulnerability Found a mistake?

Introduced: 3 May 2022

CVE-2022-1473 Open this link in a new tab
CWE-459 Open this link in a new tab

How to fix?

Upgrade Ubuntu:16.04 openssl to version 1.0.2g-1ubuntu4.20+esm3 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Ubuntu. See How to fix? for Ubuntu:16.04 relevant fixed versions and status.

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).