DEBIAN-CVE-2024-2511

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/DEBIAN-CVE-2024-2511
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-2511.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2024-2511
Upstream
Published
2024-04-08T14:15:07Z
Modified
2025-09-19T07:34:58.246811Z
Summary
[none]
Details

Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSLOPNOTICKET option is being used (but not if earlydata support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.

References

Affected packages

Debian:11 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1w-0+deb11u2

Affected versions

1.*

1.1.1k-1
1.1.1k-1+deb11u1
1.1.1k-1+deb11u2
1.1.1l-1
1.1.1m-0+deb11u1
1.1.1m-1
1.1.1n-0+deb11u1
1.1.1n-0+deb11u2
1.1.1n-0+deb11u3
1.1.1n-0+deb11u4
1.1.1n-0+deb11u5
1.1.1n-0+deb11u6
1.1.1n-1
1.1.1o-1
1.1.1v-0~deb11u1
1.1.1w-0~deb11u1
1.1.1w-0+deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.14-1~deb12u1

Affected versions

3.*

3.0.9-1
3.0.10-1~deb12u1
3.0.10-1
3.0.11-1~deb12u1
3.0.11-1~deb12u2
3.0.11-1
3.0.12-1
3.0.12-2
3.0.13-1~deb12u1
3.0.13-1~deb12u2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / openssl

Package

Name
openssl
Purl
pkg:deb/debian/openssl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}