CVE-2015-1791 is a race condition in OpenSSL's ssl3_get_new_session_ticket function, affecting versions before 0.9.8zg, 1.0.0s, 1.0.1n, and 1.0.2b. This flaw, triggered in multi-threaded clients by specific NewSessionTicket interactions, can lead to a denial of service through a double free and application crash, with potential for other unspecified impacts. Rated with a CVSS score of 6.8, it is a network-attackable vulnerability with medium complexity, posing partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, no known exploit code (Metasploit, Nuclei, ExploitDB), and it has received limited community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.9.8zfCPE matchmatch criteria | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | ||
1.0.0CPE matchmatch criteria | cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:* | ||
1.0.0CPE matchmatch criteria | cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:* | ||
1.0.0CPE matchmatch criteria | cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:* | ||
1.0.0CPE matchmatch criteria | cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.