The OpenSSL project released version 4.1.0, introducing support for DTLS 1.3 but also listing four known bugs in the DTLS code.
The vulnerability or weakness
The four bugs can affect developers who adopt DTLS 1.3 or the DTLS support added to OpenSSL’s SSL listener API, potentially leading to misreads of a connection’s state and connection errors.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations using DTLS 1.3 may face operational disruptions and potential data transmission issues, impacting their operations and possibly leading to service downtime.
Users affected
Users of applications that integrate DTLS 1.3 or OpenSSL’s DTLS support may experience connection errors and misread states, necessitating careful management and testing.
Build these skills
Sources
- OpenSSL 4.1.0: What’s new, what’s removed, and what’s still broken (Help Net Security)
