CVE-2013-0166 in OpenSSL
Summary
OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Reservation
12/06/2012
Disclosure
02/08/2013
Status
Confirmed
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 7597 | OpenSSL OSCP cryptographic issue | 310 | Unproven | Official fix | CVE-2013-0166 |