Nurullah Erinola

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions through 2.4.63 Description: In certain mod ssl configurations, a man-in-the-middle attacker can hijack an HTTP session through a TLS upgrade attack. This issue affects configurations utilizing “SSLEngine optional” to enable TLS upgrades. The attack is related to HTTP desynchronization. Recommendations: Upgrade to version 2.4.64, which removes support for TLS upgrade.

The issue is related to an easily exploitable vulnerability in the JSSE component of Oracle Java SE and Oracle GraalVM Enterprise Edition. This vulnerability allows an unauthenticated attacker with network access via DTLS to compromise the system, resulting in a partial denial of service. The vulnerability applies to Java deployments that load and run untrusted code, such as sandboxed Java Web Start applications or sandboxed Java applets, and rely on the Java sandbox for security.

The issue occurs when a DTLS resumption handshake falls back to a DTLS full handshake on a parameter mismatch without using a HelloVerifyRequest. This can result in message amplification, potentially leading to DDoS attacks on other peers, and high CPU load, leading to a DoS attack on the own peer. The misbehavior is specific to configurations where DTLS VERIFY PEERS ON RESUMPTION THRESHOLD values are larger than 0, especially when used with certificate-based cipher suites.