CVE-2013-6450

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-01-01 · updated 2026-06-17
Weakness: CWE-310

Description

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.

Affected products

OpenSSL: 1.0.0, 1.0.0-beta1, 1.0.0-beta2, 1.0.0-beta3, 1.0.0-beta4, 1.0.0-beta5 (+19)

References

http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=34628967f1e65dc8f34e000f0f5518e21afbfc7b
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136470.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136473.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00031.html
http://lists.opensuse.org/opensuse-updates/2014-01/msg00032.html
http://rhn.redhat.com/errata/RHSA-2014-0015.html
http://seclists.org/fulldisclosure/2014/Dec/23
http://security.gentoo.org/glsa/glsa-201412-39.xml
http://www-01.ibm.com/support/docview.wss?uid=isg400001841
http://www-01.ibm.com/support/docview.wss?uid=isg400001843
http://www.debian.org/security/2014/dsa-2833
http://www.openssl.org/news/vulnerabilities.html

Get alerted when CVE-2013-6450 or the next vulnerability affects your stack