CVE-2024-2511
Fixed in a distro release EPSS 52%CVSS 5.9
Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a Denial of Service This problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is being used (but not if early_data support is also configured and the default anti-replay protection is in use). In this case, under certain conditions, the session cache can get into an incorrect state and it will fail to flush properly as it fills. The session cache will continue to grow in an unbounded manner. A malicious client could deliberately create the scenario for this failure to force a Denial of Service. It may also happen by accident in normal operation. This issue only affects TLS servers supporting TLSv1.3. It does not affect TLS clients. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL 1.0.2 is also not affected by this issue.
Products: OpenSSL, Siemens RUGGEDCOM RM1224 LTE(4G) EU, Siemens RUGGEDCOM RM1224 LTE(4G) NAM, Siemens RUGGEDCOM RST2428P, Siemens SCALANCE M804PB, Siemens SCALANCE M812-1 ADSL-Router, Siemens SCALANCE M816-1 ADSL-Router, Siemens SCALANCE M826-2 SHDSL-Router, Siemens SCALANCE M874-2, Siemens SCALANCE M874-3, Siemens SCALANCE M874-3 3G-Router (CN), Siemens SCALANCE M876-3, Siemens SCALANCE M876-3 (ROK), Siemens SCALANCE M876-4, Siemens SCALANCE M876-4 (EU), Siemens SCALANCE M876-4 (NAM), Siemens SCALANCE MUM853-1 (A1), Siemens SCALANCE MUM853-1 (B1), Siemens SCALANCE MUM853-1 (EU), Siemens SCALANCE MUM856-1 (A1), Siemens SCALANCE MUM856-1 (B1), Siemens SCALANCE MUM856-1 (CN), Siemens SCALANCE MUM856-1 (EU), Siemens SCALANCE MUM856-1 (RoW), Siemens SCALANCE S615 EEC LAN-Router, Siemens SCALANCE S615 LAN-Router, Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 9 | openssl | 1:3.2.2-6.el9_5 |
| AlmaLinux 9 | openssl-devel | 1:3.2.2-6.el9_5 |
| AlmaLinux 9 | openssl-libs | 1:3.2.2-6.el9_5 |
| AlmaLinux 9 | openssl-perl | 1:3.2.2-6.el9_5 |
| Alpine 3.17 | openssl | 3.0.12-r5 |
| Alpine 3.18 | openssl | 3.1.4-r6 |
| Alpine 3.19 | openssl | 3.1.4-r6 |
| Alpine 3.20 | openssl | 3.2.1-r2 |
| Alpine 3.21 | openssl | 3.2.1-r2 |
| Alpine 3.22 | openssl | 3.2.1-r2 |
| Alpine 3.23 | openssl | 3.2.1-r2 |
| Alpine 3.24 | openssl | 3.2.1-r2 |
| Chainguard | libcrypto3 | 3.3.0-r5 |
| Chainguard | libssl3 | 3.3.0-r5 |
| Chainguard | openssl | 3.3.0-r5 |
| Chainguard | openssl-config | 3.3.0-r5 |
| Chainguard | openssl-dbg | 3.3.0-r5 |
| Chainguard | openssl-dev | 3.3.0-r5 |
| Chainguard | openssl-doc | 3.3.0-r5 |
| Chainguard | openssl-engine-afalg | 3.3.0-r5 |
| Chainguard | openssl-engine-capi | 3.3.0-r5 |
| Chainguard | openssl-engine-loader-attic | 3.3.0-r5 |
| Chainguard | openssl-engine-padlock | 3.3.0-r5 |
| Chainguard | openssl-provider-fips | 0 |
| Chainguard | openssl-provider-fips-3.1.2 | 0 |
| Chainguard | openssl-provider-fips-3.1.2-dbg | 0 |
| Chainguard | openssl-provider-legacy | 3.3.0-r5 |
| Debian 11 | openssl | 1.1.1w-0+deb11u2 |
| Debian 11 | openssl | 1.1.1n-0+deb11u6 |
| Debian 12 | openssl | 3.0.14-1~deb12u1 |
| Debian 13 | openssl | 3.2.2-1 |
| Debian 14 | openssl | 3.2.2-1 |
| Red Hat Enterprise Linux 9 | openssl | 1:3.2.2-6.el9_5 |
| Red Hat Enterprise Linux 9 | openssl-debuginfo | 1:3.2.2-6.el9_5 |
| Red Hat Enterprise Linux 9 | openssl-debugsource | 1:3.2.2-6.el9_5 |
| Red Hat Enterprise Linux 9 | openssl-devel | 1:3.2.2-6.el9_5 |
| Red Hat Enterprise Linux 9 | openssl-libs | 1:3.2.2-6.el9_5 |
| Red Hat Enterprise Linux 9 | openssl-libs-debuginfo | 1:3.2.2-6.el9_5 |
| Red Hat Enterprise Linux 9 | openssl-perl | 1:3.2.2-6.el9_5 |
| Rocky Linux 9 | openssl | 1:3.2.2-6.el9_5.1 |
| Rocky Linux 9 | openssl-fips-provider | 0:3.0.7-6.el9_5 |
| SUSE Enterprise Storage 7.1 | openssl-1_1 | 1.1.1d-150200.11.88.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | openssl-1_1 | 1.1.1d-150200.11.88.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | openssl-1_1 | 1.1.1d-150200.11.88.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | openssl-3 | 3.0.8-150400.4.54.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | openssl-3 | 3.0.8-150400.4.54.1 |
| SUSE Linux Enterprise Micro 5.1 | openssl-1_1 | 1.1.1d-150200.11.88.1 |
| SUSE Linux Enterprise Micro 5.2 | openssl-1_1 | 1.1.1d-150200.11.88.1 |
| SUSE Linux Enterprise Micro 5.3 | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| SUSE Linux Enterprise Micro 5.3 | openssl-3 | 3.0.8-150400.4.54.1 |
| SUSE Linux Enterprise Micro 5.4 | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| SUSE Linux Enterprise Micro 5.4 | openssl-3 | 3.0.8-150400.4.54.1 |
| SUSE Linux Enterprise Micro 5.5 | openssl-1_1 | 1.1.1l-150500.17.28.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | openssl-1_1 | 1.1.1l-150500.17.28.2 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | openssl-3 | 3.0.8-150500.5.30.1 |
| SUSE Linux Enterprise Server 12 SP5 | openssl-1_1 | 1.1.1d-2.110.2 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | openssl-1_1 | 1.1.1d-150200.11.88.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | openssl-1_1 | 1.1.1d-150200.11.88.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | openssl-3 | 3.0.8-150400.4.54.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | openssl-1_1 | 1.1.1d-2.110.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | openssl-1_1 | 1.1.1d-150200.11.88.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | openssl-1_1 | 1.1.1d-150200.11.88.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | openssl-3 | 3.0.8-150400.4.54.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | openssl-1_1 | 1.1.1d-2.110.2 |
| SUSE Linux Micro 6.0 | jitterentropy | 3.4.1-3.1 |
| SUSE Linux Micro 6.0 | libpulp | 0.3.5-1.1 |
| SUSE Linux Micro 6.0 | openssl-3 | 3.1.4-6.1 |
| SUSE Manager Proxy 4.3 | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| SUSE Manager Proxy 4.3 | openssl-3 | 3.0.8-150400.4.54.1 |
| SUSE Manager Server 4.3 | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| SUSE Manager Server 4.3 | openssl-3 | 3.0.8-150400.4.54.1 |
| Ubuntu 20.04 LTS | openssl | 1.1.1f-1ubuntu2.23 |
| Ubuntu 22.04 LTS | edk2 | 2022.02-3ubuntu0.22.04.4 |
| Ubuntu 22.04 LTS | openssl | 3.0.2-0ubuntu1.17 |
| Ubuntu 24.04 LTS | edk2 | 2024.02-2ubuntu0.6 |
| Ubuntu 24.04 LTS | openssl | 3.0.13-0ubuntu3.2 |
| Ubuntu Pro 14.04 LTS | openssl | 1.0.1f-1ubuntu2.27+esm16 |
| Ubuntu Pro 16.04 LTS | edk2 | no fix |
| Ubuntu Pro 16.04 LTS | nodejs | no fix |
| Ubuntu Pro 16.04 LTS | openssl | 1.0.2g-1ubuntu4.20+esm18 |
| Ubuntu Pro 18.04 LTS | edk2 | no fix |
| Ubuntu Pro 18.04 LTS | nodejs | no fix |
| Ubuntu Pro 18.04 LTS | openssl | 1.1.1-1ubuntu2.1~18.04.23+esm10 |
| Ubuntu Pro 18.04 LTS | openssl1.0 | 1.0.2n-1ubuntu5.13+esm6 |
| Ubuntu Pro 20.04 LTS | edk2 | no fix |
| Ubuntu Pro 20.04 LTS | openssl | 1.1.1f-1ubuntu2.24+esm5 |
| Ubuntu Pro 22.04 LTS | nodejs | no fix |
| Ubuntu Pro FIPS-preview 22.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS-preview 22.04 LTS | openssl-fips | no fix |
| Ubuntu Pro FIPS-updates 16.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS-updates 18.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS-updates 22.04 LTS | openssl | 3.0.2-0ubuntu1.17+Fips1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | openssl-fips | no fix |
| Ubuntu Pro FIPS-updates 24.04 LTS | openssl-fips | 3.0.13-0ubuntu3.6+Fips1 |
| Ubuntu Pro FIPS 16.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS 18.04 LTS | openssl | no fix |
| Ubuntu Pro FIPS 20.04 LTS | openssl | no fix |
| Wolfi | libcrypto3 | 3.3.0-r5 |
| Wolfi | libssl3 | 3.3.0-r5 |
| Wolfi | openssl | 3.3.0-r5 |
| Wolfi | openssl-config | 3.3.0-r5 |
| Wolfi | openssl-dbg | 3.3.0-r5 |
| Wolfi | openssl-dev | 3.3.0-r5 |
| Wolfi | openssl-doc | 3.3.0-r5 |
| Wolfi | openssl-engine-afalg | 3.3.0-r5 |
| Wolfi | openssl-engine-capi | 3.3.0-r5 |
| Wolfi | openssl-engine-loader-attic | 3.3.0-r5 |
| Wolfi | openssl-engine-padlock | 3.3.0-r5 |
| Wolfi | openssl-provider-legacy | 3.3.0-r5 |
| openSUSE Leap 15.5 | openssl-1_1 | 1.1.1l-150500.17.28.2 |
| openSUSE Leap 15.5 | openssl-3 | 3.0.8-150500.5.30.1 |
| openSUSE Leap Micro 5.3 | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| openSUSE Leap Micro 5.3 | openssl-3 | 3.0.8-150400.4.54.1 |
| openSUSE Leap Micro 5.4 | openssl-1_1 | 1.1.1l-150400.7.66.2 |
| openSUSE Leap Micro 5.4 | openssl-3 | 3.0.8-150400.4.54.1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1w-9.1 |
| openSUSE Tumbleweed | openssl-3 | 3.1.4-6.1 |