description: A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to an implementation error within the SSL/TLS session handling process that can prevent the release of a session handler under specific conditions. An attacker could exploit this vulnerability by sending crafted SSL/TLS traffic to an affected device, increasing the probability of session handler leaks. A successful exploit could allow the attacker to eventually deplete the available session handler pool, preventing new sessions from being established and causing a DoS condition.
problem types: Improper Resource Shutdown or Release
affected:
{
vendor: Cisco
product: Cisco Adaptive Security Appliance (ASA) Software
versions:
version: 9.16.1, status: affected
version: 9.16.1.28, status: affected
version: 9.16.2, status: affected
version: 9.16.2.3, status: affected
version: 9.16.2.7, status: affected
version: 9.16.2.11, status: affected
version: 9.16.2.13, status: affected
version: 9.16.2.14, status: affected
version: 9.16.3, status: affected
version: 9.16.3.3, status: affected
version: 9.16.3.14, status: affected
version: 9.16.3.15, status: affected
version: 9.16.3.19, status: affected
version: 9.16.3.23, status: affected
version: 9.16.4, status: affected
version: 9.16.4.9, status: affected
version: 9.17.1, status: affected
version: 9.17.1.7, status: affected
version: 9.17.1.9, status: affected
version: 9.17.1.10, status: affected
version: 9.17.1.11, status: affected
version: 9.17.1.13, status: affected
version: 9.17.1.15, status: affected
version: 9.17.1.20, status: affected
version: 9.18.1, status: affected
version: 9.18.1.3, status: affected
version: 9.18.2, status: affected
version: 9.18.2.5, status: affected
version: 9.18.2.7, status: affected
version: 9.19.1, status: affected
}
{
vendor: Cisco
product: Cisco Firepower Threat Defense Software
versions:
version: 7.0.0, status: affected
version: 7.0.0.1, status: affected
version: 7.0.1, status: affected
version: 7.0.1.1, status: affected
version: 7.0.2, status: affected
version: 7.0.2.1, status: affected
version: 7.0.3, status: affected
version: 7.0.4, status: affected
version: 7.0.5, status: affected
version: 7.1.0, status: affected
version: 7.1.0.1, status: affected
version: 7.1.0.2, status: affected
version: 7.1.0.3, status: affected
version: 7.2.0, status: affected
version: 7.2.0.1, status: affected
version: 7.2.1, status: affected
version: 7.2.2, status: affected
version: 7.2.3, status: affected
version: 7.3.0, status: affected
version: 7.3.1, status: affected
version: 7.3.1.1, status: affected
}
metrics:
format: cvssV3_1
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
baseScore: 6.8
baseSeverity: MEDIUM
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
]
exploits: The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.