{"uuid": "fb82e370-87ba-4dd8-9e3e-7100b766612e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2018-0733", "type": "seen", "source": "https://t.me/information_security_channel/15321", "content": "First OpenSSL Updates in 2018 Patch Three Flaws\nhttp://feedproxy.google.com/~r/Securityweek/~3/lDXRblL_tHQ/first-openssl-updates-2018-patch-three-flaws\n\nThe first round of security updates released in 2018 for OpenSSL patch a total of three vulnerabilities, but none of them appears to be serious.\nOpenSSL versions 1.1.0h and 1.0.2o patch CVE-2018-0739, a denial-of-service (DoS) vulnerability discovered using Google\u2019s OSS-Fuzz service, which has helped find (https://www.securityweek.com/openssl-patches-flaws-found-google-fuzzer) several flaws in OpenSSL in the past period.\nThe security hole, rated \u201cmoderate,\u201d is related to constructed ASN.1 types with a recursive definition.\n\u201cConstructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion,\u201d the OpenSSL Project said in its advisory (https://www.openssl.org/news/secadv/20180327.txt).\nAnother moderate severity flaw, which only affects the 1.1.0 branch, is CVE-2018-0733. This is an implementation bug in the PA-RISC (https://en.wikipedia.org/wiki/PA-RISC) CRYPTO_memcmp function, and it allows an attacker to forge authenticated messages easier than it should be.\nThe OpenSSL Project learned about this vulnerability in early March from IBM. Only HP-UX PA-RISC systems are impacted.\nFinally, OpenSSL 1.1.0h fixes an overflow bug that could allow an attacker to access TLS-protected communications. The vulnerability, CVE-2017-3738, was first disclosed (https://www.securityweek.com/two-vulnerabilities-patched-openssl) in December 2017, but since an attack is not easy to carry out the issue has been assigned a low severity rating and it has only been patched now.\nFour rounds of security updates were released for OpenSSL last year, and only one of the eight fixed vulnerabilities was classified as high severity.", "creation_timestamp": "2018-03-27T18:32:30.000000Z"}