OpenSSL Addresses 'HollowByte' Vulnerability to Prevent Denial-of-Service Attacks
OpenSSL has silently patched a vulnerability known as 'HollowByte' that could allow attackers to exhaust a server's memory, leading to a denial-of-service (DoS) condition. Discovered by Okta's red team, the vulnerability involves a malicious payload that triggers a buffer pre-allocation based on a declared message size, which is not immediately freed. This flaw affects older OpenSSL versions, allowing attackers to send multiple payloads to exhaust server memory. The vulnerability impacts various applications and servers using OpenSSL, including Apache, NGINX, and MySQL. Patches have been included in OpenSSL version 4.0.1 and backported to earlier versions, addressing the issue by adjusting buffer allocation practices. 
