CVE-2011-4108: OpenSSL

Medium severity, CVSS 4.3. EPSS: 16.1% chance of exploitation in the next 30 days.

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

Affected products

• OpenSSL OpenSSL: up to and including 0.9.8r; version 0.9.1c only; version 0.9.2b only; version 0.9.4 only; version 0.9.5 only; version 0.9.5a only; …

Published 2012-01-06. Last modified 2026-06-16.