From ${URL} : It was found that when doing handshake/renegotiation, it's possible to bypass DTLS replay protection by sending a record for the next epoch (which does not have to decrypt or have a valid MAC), with a very large sequence number. This means the right hand edge of the window is moved very far to the right, and all subsequent legitimate packets are dropped causing a denial of service. Upstream patches: https://github.com/openssl/openssl/commit/5802758eb480c5f14a768f6a061df1dd20aec8c4 https://github.com/openssl/openssl/commit/b77ab018b79a00f789b0fb85596b446b08be4c9d https://github.com/openssl/openssl/commit/fa75569758298e2930c78989b516cac937118acc @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Added to an existing GLSA Request.
This issue was resolved and addressed in GLSA 201612-16 at https://security.gentoo.org/glsa/201612-16 by GLSA coordinator Aaron Bauman (b-man).
