View at Official ubuntu advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2016-6302 low priority: Ubuntu including 2 source packages (openssl, openssl098), 20 status rows across 10 suites (artful, bionic, cosmic, disco, precise, trusty, upstream, xenial, yakkety, zesty): released 10, DNE 8, ignored 1, needs-triage 1.
The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.