SSL/TLS: Renegotiation DoS Vulnerability (CVE-2011-1473, CVE-2011-5094) #538
Description
Hi,
during the security audit of our REST-API, which uses the restbed library, a vulnerability regarding SSL/TLS occurred.
The following CVEs are referenced:
- CVE-2011-1473
- CVE-2011-5094
TLDR; An attacker can perform a computational DoS attack by performing many renegotiations within a single connection.
I have not found a way in the API (https://github.com/Corvusoft/restbed/blob/master/documentation/API.md#sslsettings) to limit renegotiations nor to disable them at all.
libraries:
- restbed 4.8
- openssl 1.1.1
Additional reference:
https://vincent.bernat.ch/en/blog/2011-ssl-dos-mitigation