Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

OpenSSL older versions can be forced to consume CPU

CVE-2011-4619 · published 14 years ago
Summary

Debian systems using OpenSSL versions before 0.9.8s or 1.0.0f can be tricked into repeatedly restarting a secure connection, which makes the server use a lot of processing power. This can slow down or stop the service for legitimate users. Update OpenSSL to a newer release or apply the available security patches to stop the problem.

What to do
  • Update debian openssl to version 1.0.0h-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian openssl < 1.0.0h-1
Fix: upgrade to 1.0.0h-1
Debian:13 debian openssl < 1.0.0h-1
Fix: upgrade to 1.0.0h-1
Debian:14 debian openssl < 1.0.0h-1
Fix: upgrade to 1.0.0h-1
– openssl openssl <= 0.9.8r
0.9.1c
0.9.2b
0.9.4
0.9.5
0.9.5a
0.9.6
0.9.6a
0.9.6b
0.9.6c
0.9.6d
0.9.6e
46 more version ranges
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Original advisory text
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of ser...
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
References
Severity
5.0 Medium
Exploitation
18% chance of attack within 30 days
Type
CWE-399Resource Management Errors
Timeline
Published6 Jan 2012
Updated29 Sep 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2011-4619 · OSV
CVE-2011-4619 · NVD
Track software like this
Free during beta