CVE-2016-2180

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.2h and earlier

Description The issue is related to a denial of service caused by an out-of-bounds read and application crash. This can be triggered by a remote attacker via a crafted time-stamp file that is mishandled by the "openssl ts" command. The problem is associated with the TS OBJ print bio function in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation. Additionally, there is a mention of a missing CRL sanity check that could also lead to a denial of service.

Recommendations For OpenSSL versions 1.0.2h and earlier, update to a version that includes the necessary patches to address the denial of service issue. As a temporary workaround, consider restricting the use of the "openssl ts" command until a patch is available. Avoid using crafted time-stamp files that could exploit the TS OBJ print bio function.