CVE-2016-8610

Published: Nov 13, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

Affected (78)

Products: Openssl: Openssl · Debian: Debian Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Server Tus, Enterprise Linux Workstation, Jboss Enterprise Application Platform · +4 more

Show all products

Openssl: Openssl · Debian: Debian Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Enterprise Linux Server Tus, Enterprise Linux Workstation, Jboss Enterprise Application Platform · Netapp: Cn1610 Firmware, Clustered Data Ontap, Clustered Data Ontap Antivirus Connector, Data Ontap, Data Ontap Edge, E Series Santricity Os Controller, Host Agent, Oncommand Balance, Oncommand Unified Manager, Oncommand Workflow Automation, Ontap Select Deploy, Service Processor, Smi S Provider, Snapcenter Server, Snapdrive, Storagegrid, Storagegrid Webscale · Paloaltonetworks: Pan Os · Oracle: Adaptive Access Manager, Application Testing Suite, Communications Analytics, Communications Ip Service Activator, Core Rdbms, Enterprise Manager Ops Center, Goldengate Application Adapters, Jd Edwards Enterpriseone Tools, Peoplesoft Enterprise Peopletools, Retail Predictive Application Server, Timesten In Memory Database, Weblogic Server · Fujitsu: M10 1 Firmware, M10 4 Firmware, M10 4s Firmware, M12 1 Firmware, M12 2 Firmware, M12 2s Firmware

1 product

1 product

7 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Jboss Enterprise Application Platform

Netapp

17 products

Cn1610 Firmware

Clustered Data Ontap

Clustered Data Ontap Antivirus Connector

Data Ontap

Data Ontap Edge

E Series Santricity Os Controller

Host Agent

Oncommand Balance

Oncommand Unified Manager

Oncommand Workflow Automation

1 product

12 products

Adaptive Access Manager

Application Testing Suite

Communications Analytics

Communications Ip Service Activator

Core Rdbms

Enterprise Manager Ops Center

Goldengate Application Adapters

Jd Edwards Enterpriseone Tools

Peoplesoft Enterprise Peopletools

Retail Predictive Application Server

Timesten In Memory Database

6 products

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	From 1.0.2 to 1.0.2h
Openssl Openssl	Version 0.9.8
Openssl Openssl	Version 1.0.1
Openssl Openssl	Version 1.1.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 8.0

Configuration C

15 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 6.0
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 6.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.3
Redhat Enterprise Linux Server Aus	Version 7.4
Redhat Enterprise Linux Server Aus	Version 7.6
Redhat Enterprise Linux Server Eus	Version 7.3
Redhat Enterprise Linux Server Eus	Version 7.4
Redhat Enterprise Linux Server Eus	Version 7.5
Redhat Enterprise Linux Server Eus	Version 7.6
Redhat Enterprise Linux Server Tus	Version 7.3
Redhat Enterprise Linux Server Tus	Version 7.6
Redhat Enterprise Linux Workstation	Version 6.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration D

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Jboss Enterprise Application Platform	Version 6.0.0
Redhat Jboss Enterprise Application Platform	Version 6.4.0

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Netapp Cn1610 Firmware	All versions

Running on/with	Platform Versions
Netapp Cn1610	All versions

Configuration F

16 vulnerable

Vulnerable Software	Affected Versions
Netapp Clustered Data Ontap	All versions
Netapp Clustered Data Ontap Antivirus Connector	All versions
Netapp Data Ontap	All versions
Netapp Data Ontap Edge	All versions
Netapp E Series Santricity Os Controller	From 11.0 to 11.40
Netapp Host Agent	All versions
Netapp Oncommand Balance	All versions
Netapp Oncommand Unified Manager	All versions
Netapp Oncommand Workflow Automation	All versions
Netapp Ontap Select Deploy	All versions
Netapp Service Processor	All versions
Netapp Smi S Provider	All versions
Netapp Snapcenter Server	All versions
Netapp Snapdrive	All versions
Netapp Storagegrid	All versions
Netapp Storagegrid Webscale	All versions

Configuration G

3 vulnerable

Vulnerable Software	Affected Versions
Paloaltonetworks Pan Os	Up to 6.1.17
Paloaltonetworks Pan Os	From 7.0.0 to 7.0.15
Paloaltonetworks Pan Os	From 7.1.0 to 7.1.10

Configuration H

24 vulnerable

Vulnerable Software	Affected Versions
Oracle Adaptive Access Manager	Version 11.1.2.3.0
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Communications Analytics	Version 12.1.1
Oracle Communications Ip Service Activator	Version 7.3.4
Oracle Communications Ip Service Activator	Version 7.4.0
Oracle Core Rdbms	Version 11.2.0.4
Oracle Core Rdbms	Version 12.1.0.2
Oracle Core Rdbms	Version 12.2.0.1
Oracle Core Rdbms	Version 18c
Oracle Core Rdbms	Version 19c
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Enterprise Manager Ops Center	Version 12.4.0
Oracle Goldengate Application Adapters	Version 12.3.2.1.0
Oracle Jd Edwards Enterpriseone Tools	Version 9.2
Oracle Peoplesoft Enterprise Peopletools	Version 8.56
Oracle Peoplesoft Enterprise Peopletools	Version 8.57
Oracle Peoplesoft Enterprise Peopletools	Version 8.58
Oracle Retail Predictive Application Server	Version 15.0.3
Oracle Retail Predictive Application Server	Version 16.0.3
Oracle Timesten In Memory Database	Before 18.1.4.1.0
Oracle Weblogic Server	Version 10.3.6.0.0
Oracle Weblogic Server	Version 12.1.3.0.0
Oracle Weblogic Server	Version 12.2.1.3.0
Oracle Weblogic Server	Version 12.2.1.4.0

Configuration I

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 1 Firmware	Before xcp2361
Fujitsu M10 1 Firmware	From xcp3000 to xcp3070

Running on/with	Platform Versions
Fujitsu M10 1	All versions

Configuration J

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4 Firmware	Before xcp2361
Fujitsu M10 4 Firmware	From xcp3000 to xcp3070

Running on/with	Platform Versions
Fujitsu M10 4	All versions

Configuration K

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M10 4s Firmware	Before xcp2361
Fujitsu M10 4s Firmware	From xcp3000 to xcp3070

Running on/with	Platform Versions
Fujitsu M10 4s	All versions

Configuration L

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 1 Firmware	Before xcp2361
Fujitsu M12 1 Firmware	From xcp3000 to xcp3070

Running on/with	Platform Versions
Fujitsu M12 1	All versions

Configuration M

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2 Firmware	Before xcp2361
Fujitsu M12 2 Firmware	From xcp3000 to xcp3070

Running on/with	Platform Versions
Fujitsu M12 2	All versions

Configuration N

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Fujitsu M12 2s Firmware	Before xcp2361
Fujitsu M12 2s Firmware	From xcp3000 to xcp3070

Running on/with	Platform Versions
Fujitsu M12 2s	All versions

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

References (56)

http://rhn.redhat.com/errata/RHSA-2017-0286.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-0574.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-1415.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-1659.html

Source: secalert@redhat.com

Third Party Advisory

http://seclists.org/oss-sec/2016/q4/224

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/93841

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037084

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:1413

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1414

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1658

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1801

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:1802

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2493

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2017:2494

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401

Source: secalert@redhat.com

Broken Link

https://security.360.cn/cve/CVE-2016-8610/

Source: secalert@redhat.com

Third Party Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc

Source: secalert@redhat.com

Third Party Advisory

https://security.netapp.com/advisory/ntap-20171130-0001/

Source: secalert@redhat.com

Third Party Advisory

https://security.paloaltonetworks.com/CVE-2016-8610

Source: secalert@redhat.com

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us

Source: secalert@redhat.com

Third Party Advisory

https://www.debian.org/security/2017/dsa-3773

Source: secalert@redhat.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: secalert@redhat.com

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: secalert@redhat.com

PatchThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-0286.html