Search for vulnerabilities
Vulnerability details: VCID-yr2h-w72w-aaab
Vulnerability ID VCID-yr2h-w72w-aaab
Aliases CVE-2024-2511
Summary Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
Status Published
Exploitability 0.5
Weighted Severity 5.3
Risk 2.6
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-400 Uncontrolled Resource Consumption
CWE-1325 Improperly Controlled Sequential Memory Allocation
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2511.json
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00309 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00309 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00309 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00309 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.00309 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.0067 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01154 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01154 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01154 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01154 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01474 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01486 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01486 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01486 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.01486 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02023 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02023 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02023 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02023 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02023 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02023 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02023 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.02078 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
epss 0.0416 https://api.first.org/data/v1/epss?cve=CVE-2024-2511
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
ssvc Track https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
ssvc Track https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
ssvc Track https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
ssvc Track https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
cvssv3.1 5.9 https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
ssvc Track https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
ssvc Track https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
cvssv3.1 5.9 https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
cvssv3.1 5.9 https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
ssvc Track https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
ssvc Track https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
cvssv3.1 5.9 https://www.openssl.org/news/secadv/20240408.txt
cvssv3.1 5.9 https://www.openssl.org/news/secadv/20240408.txt
ssvc Track https://www.openssl.org/news/secadv/20240408.txt
ssvc Track https://www.openssl.org/news/secadv/20240408.txt
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2511.json
https://api.first.org/data/v1/epss?cve=CVE-2024-2511
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2511
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
https://security.netapp.com/advisory/ntap-20240503-0013/
https://www.openssl.org/news/secadv/20240408.txt
http://www.openwall.com/lists/oss-security/2024/04/08/5
1068658 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068658
2274020 https://bugzilla.redhat.com/show_bug.cgi?id=2274020
CVE-2024-2511 https://nvd.nist.gov/vuln/detail/CVE-2024-2511
RHSA-2024:9333 https://access.redhat.com/errata/RHSA-2024:9333
USN-6937-1 https://usn.ubuntu.com/6937-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-2511.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.openssl.org/news/secadv/20240408.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.openssl.org/news/secadv/20240408.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://www.openssl.org/news/secadv/20240408.txt
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-09T15:14:41Z/ Found at https://www.openssl.org/news/secadv/20240408.txt
Exploit Prediction Scoring System (EPSS)
Percentile 0.16666
EPSS Score 0.00045
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-04-23T17:18:44.602707+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2024-2511 34.0.0rc4