Moderate Vulnerability in OpenSSL: Denial of Service Risk in X.509 Name Checks
Summary
ALSA-2024:6783: Moderate: openssl security update. Affects openssl versions < 1:3.0.7-28.el9_4. Fixed in 1:3.0.7-28.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, along with a comprehensive general-purpose cryptography library. It is essential for secure communications over networks and is utilized in various applications and services. The recent vulnerability affects OpenSSL versions prior to 1:3.0.7-28.el9_4, exposing systems to potential denial of service attacks due to flaws in X.509 name checks.
Vulnerability Detail
The vulnerability identified as CVE-2024-6119 allows for a possible denial of service in X.509 name checks within OpenSSL. This issue arises from improper handling of certain inputs during the verification of X.509 certificates, which could lead to application crashes or unresponsive states. Attackers could exploit this vulnerability by sending specially crafted requests to the affected systems, potentially disrupting service availability and impacting users.
How To Fix
Minimum fixed version
1:3.0.7-28.el9_4
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the security update as soon as possible to mitigate the risk.
Conclusion
The OpenSSL vulnerability identified as CVE-2024-6119 poses a moderate risk of denial of service due to flaws in X.509 name checks. It is crucial for users to update their OpenSSL packages to the fixed version to ensure the security and reliability of their applications. Regular monitoring and prompt updates are essential to mitigate such vulnerabilities.
See every vulnerability recorded for openssl →
FAQ
CVE-2024-6119 is a vulnerability in OpenSSL that could lead to a denial of service due to improper handling of X.509 name checks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
The primary impact is a denial of service, where affected applications may crash or become unresponsive, affecting service availability for users.
It is not safe to continue using the affected version, as it exposes your application to potential denial of service attacks. It is recommended to update to the fixed version immediately.
More information can be found on the CVE page for CVE-2024-6119, which provides detailed insights into the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
