CVE-2020-12457

HIGH Year: 2020
CVSS v3 Score
7.5
High
CVSS v2 Score
5.0
Medium
Weakness Type
CWE-835
View all →

Vulnerability Description

An issue was discovered in wolfSSL before 4.5.0. It mishandles the change_cipher_spec (CCS) message processing logic for TLS 1.3. If an attacker sends ChangeCipherSpec messages in a crafted way involving more than one in a row, the server becomes stuck in the ProcessReply() loop, i.e., a denial of service.

Related Vulnerabilities

CVE-2011-1142

HIGH
CVSS:7.5(High)

Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of serv...

CWE-8352011

CVE-2013-10005

HIGH
CVSS:7.5(High)

The RemoteAddr and LocalAddr methods on the returned net.Conn may call themselves, leading to an infinite loop which will crash the program due to a stack overflow.

CWE-8352013

CVE-2013-3722

HIGH
CVSS:7.5(High)

A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.

CWE-8352013

CVE-2013-7488

HIGH
CVSS:7.5(High)

perl-Convert-ASN1 (aka the Convert::ASN1 module for Perl) through 0.27 allows remote attackers to cause an infinite loop via unexpected input.

CWE-8352013

CVE-2016-4970

HIGH
CVSS:7.5(High)

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).

CWE-8352016

CVE-2016-5042

HIGH
CVSS:7.5(High)

The dwarf_get_aranges_list function in libdwarf before 20160923 allows remote attackers to cause a denial of service (infinite loop and crash) via a crafted DWARF section.

CWE-8352016