CVE-2016-8610

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 39.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-13 · updated 2026-06-17
Weakness: CWE-400

Description

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

Affected products

Debian Linux: 8.0
Fujitsu M10-1 Firmware: before xcp2361; from xcp3000 before xcp3070 — fixed in xcp2361, xcp3070
Fujitsu M10-4 Firmware: before xcp2361; from xcp3000 before xcp3070 — fixed in xcp2361, xcp3070
Fujitsu M10-4S Firmware: before xcp2361; from xcp3000 before xcp3070 — fixed in xcp2361, xcp3070
Fujitsu M12-1 Firmware: before xcp2361; from xcp3000 before xcp3070 — fixed in xcp2361, xcp3070
Fujitsu M12-2 Firmware: before xcp2361; from xcp3000 before xcp3070 — fixed in xcp2361, xcp3070
Fujitsu M12-2S Firmware: before xcp2361; from xcp3000 before xcp3070 — fixed in xcp2361, xcp3070
Clustered Data ONTAP: all versions
NetApp Clustered Data Ontap Antivirus Connector: all versions
NetApp Cn1610 Firmware: all versions
NetApp Data ONTAP operating in 7-Mode: all versions
NetApp Data Ontap Edge: all versions
E-Series SANtricity OS Controller Software 11.x: from 11.0 through 11.40
NetApp Host Agent: all versions
NetApp Oncommand Balance: all versions
NetApp OnCommand Unified Manager for 7-Mode (core package): all versions
NetApp OnCommand Workflow Automation: all versions
NetApp Ontap Select Deploy: all versions
NetApp, Inc. NetApp Service Processor: all versions
NetApp Smi-S Provider: all versions
NetApp SnapCenter Server: all versions
NetApp Snapdrive: all versions
NetApp StorageGRID: all versions
NetApp StorageGRID Webscale: all versions
OpenSSL: from 1.0.2 through 1.0.2h; 0.9.8, 1.0.1, 1.1.0
Oracle Corporation Adaptive Access Manager: 11.1.2.3.0
Oracle Corporation Oracle Application Testing Suite: 13.3.0.1
Oracle Communications Analytics: 12.1.1
Oracle Communications Ip Service Activator: 7.3.4, 7.4.0
Oracle Core Rdbms: 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c, 19c

How to fix

Upgrade to a fixed version: Fujitsu M10-1 Firmware xcp2361, xcp3070; Fujitsu M10-4 Firmware xcp2361, xcp3070; Fujitsu M10-4S Firmware xcp2361, xcp3070; Fujitsu M12-1 Firmware xcp2361, xcp3070; Fujitsu M12-2 Firmware xcp2361, xcp3070; Fujitsu M12-2S Firmware xcp2361, xcp3070; Oracle Corporation TimesTen In-Memory Database 18.1.4.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-8610 or the next vulnerability affects your stack