Summary
It was discovered that OpenSSL incorrectly allocated memory buffers in the
SSL/TLS state machine when receiving handshake data. A remote attacker
could possibly use this issue to cause OpenSSL to consume excessive memory,
leading to a denial of service. This issue is known as the "HollowByte"
denial of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | openssl | 3.0.2-0ubuntu1.26 |
| Ubuntu · 24.04 LTS 24.04:LTS | openssl | 3.0.13-0ubuntu3.12 |
| Ubuntu · 26.04 LTS 26.04:LTS | openssl | 3.5.5-1ubuntu3.3 |
References
-
report
https://launchpad.net/bugs/2161371