SUSE-SU-2018:0112-1 - Vulnerability-Lookup

SUSE-SU-2018:0112-1

Vulnerability from csaf_suse - Published: 2018-01-16 12:36 - Updated: 2018-01-16 12:36

Summary

Security update for openssl

Severity

Important

Notes

Title of the patch: Security update for openssl

Description of the patch: This update for openssl fixes the following issues: Security issues fixed: - CVE-2016-7056: ECSDA P-256 timing attack key recovery (bsc#1019334) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085) - CVE-2016-8610: remote denial of service in SSL alert handling (bsc#1005878) - CVE-2017-3735: Malformed X.509 IPAdressFamily could cause OOB read (bsc#1056058) Bug fixes: - support alternate root ca chains (bsc#1032261) - X509_get_default_cert_file() returns an incorrect path (bsc#1022271) - Segmentation fault in 'openssl speed' when engine library file cannot be found (bsc#1000677) - adjust DEFAULT_SUSE to meet 1.0.2 and current state (bsc#1027908) - Missing important ciphers in openssl 1.0.1i-47.1 on SLES12 SP1 (bsc#990592) - out of bounds read+crash in DES_fcrypt (bsc#1065363) - tracker bug for January 26th 2017 release (bsc#1021641) - patch for CVE-2016-2108 fails negative zero exploit (bsc#1001502) - Birthday attacks on 64-bit block ciphers aka triple-des (SWEET32) (bsc#1001912) - Include additional patch for CVE-2016-2108 (bsc#1004499) - openssl DEFAULT_SUSE cipher list is missing ECDHE-ECDSA ciphers (bsc#1055825)

Patchnames: SUSE-SLE-SERVER-12-2018-79

Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

CVE-2016-2108

9.8 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2016-7056

5.5 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2016-8610

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2017-3731

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

CVE-2017-3735

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

References

URL

Category

	https://www.suse.com/support/security/rating/	external
	https://ftp.suse.com/pub/projects/security/csaf/s…	self
	https://www.suse.com/support/update/announcement/…	self
	https://lists.suse.com/pipermail/sle-security-upd…	self
	https://bugzilla.suse.com/1000677	self
	https://bugzilla.suse.com/1001502	self
	https://bugzilla.suse.com/1001912	self
	https://bugzilla.suse.com/1004499	self
	https://bugzilla.suse.com/1005878	self
	https://bugzilla.suse.com/1019334	self
	https://bugzilla.suse.com/1021641	self
	https://bugzilla.suse.com/1022085	self
	https://bugzilla.suse.com/1022271	self
	https://bugzilla.suse.com/1027908	self
	https://bugzilla.suse.com/1032261	self
	https://bugzilla.suse.com/1055825	self
	https://bugzilla.suse.com/1056058	self
	https://bugzilla.suse.com/1065363	self
	https://bugzilla.suse.com/990592	self
	https://www.suse.com/security/cve/CVE-2016-2108/	self
	https://www.suse.com/security/cve/CVE-2016-7056/	self
	https://www.suse.com/security/cve/CVE-2016-8610/	self
	https://www.suse.com/security/cve/CVE-2017-3731/	self
	https://www.suse.com/security/cve/CVE-2017-3735/	self
	https://www.suse.com/security/cve/CVE-2016-2108	external
	https://bugzilla.suse.com/1001502	external
	https://bugzilla.suse.com/1004499	external
	https://bugzilla.suse.com/1005878	external
	https://bugzilla.suse.com/1148697	external
	https://bugzilla.suse.com/977584	external
	https://bugzilla.suse.com/977617	external
	https://bugzilla.suse.com/978492	external
	https://bugzilla.suse.com/989345	external
	https://bugzilla.suse.com/996067	external
	https://www.suse.com/security/cve/CVE-2016-7056	external
	https://bugzilla.suse.com/1005878	external
	https://bugzilla.suse.com/1019334	external
	https://bugzilla.suse.com/1148697	external
	https://www.suse.com/security/cve/CVE-2016-8610	external
	https://bugzilla.suse.com/1005878	external
	https://bugzilla.suse.com/1005879	external
	https://bugzilla.suse.com/1110018	external
	https://bugzilla.suse.com/1120592	external
	https://bugzilla.suse.com/1126909	external
	https://bugzilla.suse.com/1148697	external
	https://bugzilla.suse.com/982575	external
	https://www.suse.com/security/cve/CVE-2017-3731	external
	https://bugzilla.suse.com/1021641	external
	https://bugzilla.suse.com/1022085	external
	https://bugzilla.suse.com/1064118	external
	https://bugzilla.suse.com/1064119	external
	https://www.suse.com/security/cve/CVE-2017-3735	external
	https://bugzilla.suse.com/1056058	external

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for openssl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for openssl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-7056: ECSDA P-256 timing attack key recovery (bsc#1019334)\n- CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085)\n- CVE-2016-8610: remote denial of service in SSL alert handling (bsc#1005878)\n- CVE-2017-3735: Malformed X.509 IPAdressFamily could cause OOB read (bsc#1056058)\n\nBug fixes:\n\n- support alternate root ca chains (bsc#1032261)\n- X509_get_default_cert_file() returns an incorrect path (bsc#1022271)\n- Segmentation fault in \u0027openssl speed\u0027 when engine library file cannot be found (bsc#1000677)\n- adjust DEFAULT_SUSE to meet 1.0.2 and current state (bsc#1027908)\n- Missing important ciphers in openssl 1.0.1i-47.1 on SLES12 SP1 (bsc#990592)\n- out of bounds read+crash in DES_fcrypt (bsc#1065363)\n- tracker bug for January 26th 2017 release (bsc#1021641)\n- patch for CVE-2016-2108 fails negative zero exploit (bsc#1001502)\n- Birthday attacks on 64-bit block ciphers aka triple-des (SWEET32) (bsc#1001912)\n- Include additional patch for CVE-2016-2108 (bsc#1004499)\n- openssl DEFAULT_SUSE cipher list is missing ECDHE-ECDSA ciphers (bsc#1055825)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-SERVER-12-2018-79",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_0112-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:0112-1",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20180112-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:0112-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-January/003599.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1000677",
        "url": "https://bugzilla.suse.com/1000677"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1001502",
        "url": "https://bugzilla.suse.com/1001502"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1001912",
        "url": "https://bugzilla.suse.com/1001912"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1004499",
        "url": "https://bugzilla.suse.com/1004499"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1005878",
        "url": "https://bugzilla.suse.com/1005878"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1019334",
        "url": "https://bugzilla.suse.com/1019334"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1021641",
        "url": "https://bugzilla.suse.com/1021641"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1022085",
        "url": "https://bugzilla.suse.com/1022085"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1022271",
        "url": "https://bugzilla.suse.com/1022271"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1027908",
        "url": "https://bugzilla.suse.com/1027908"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1032261",
        "url": "https://bugzilla.suse.com/1032261"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1055825",
        "url": "https://bugzilla.suse.com/1055825"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1056058",
        "url": "https://bugzilla.suse.com/1056058"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1065363",
        "url": "https://bugzilla.suse.com/1065363"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 990592",
        "url": "https://bugzilla.suse.com/990592"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2108 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2108/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-7056 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-7056/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-8610 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-8610/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-3731 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-3731/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-3735 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-3735/"
      }
    ],
    "title": "Security update for openssl",
    "tracking": {
      "current_release_date": "2018-01-16T12:36:33Z",
      "generator": {
        "date": "2018-01-16T12:36:33Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:0112-1",
      "initial_release_date": "2018-01-16T12:36:33Z",
      "revision_history": [
        {
          "date": "2018-01-16T12:36:33Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-doc-1.0.1i-27.28.1.noarch",
                "product": {
                  "name": "openssl-doc-1.0.1i-27.28.1.noarch",
                  "product_id": "openssl-doc-1.0.1i-27.28.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
                "product": {
                  "name": "libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
                  "product_id": "libopenssl1_0_0-1.0.1i-27.28.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
                "product": {
                  "name": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
                  "product_id": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "openssl-1.0.1i-27.28.1.ppc64le",
                "product": {
                  "name": "openssl-1.0.1i-27.28.1.ppc64le",
                  "product_id": "openssl-1.0.1i-27.28.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-1.0.1i-27.28.1.s390x",
                "product": {
                  "name": "libopenssl1_0_0-1.0.1i-27.28.1.s390x",
                  "product_id": "libopenssl1_0_0-1.0.1i-27.28.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
                "product": {
                  "name": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
                  "product_id": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
                "product": {
                  "name": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
                  "product_id": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
                "product": {
                  "name": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
                  "product_id": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "openssl-1.0.1i-27.28.1.s390x",
                "product": {
                  "name": "openssl-1.0.1i-27.28.1.s390x",
                  "product_id": "openssl-1.0.1i-27.28.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
                "product": {
                  "name": "libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
                  "product_id": "libopenssl1_0_0-1.0.1i-27.28.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
                "product": {
                  "name": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
                  "product_id": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
                "product": {
                  "name": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
                  "product_id": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
                "product": {
                  "name": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
                  "product_id": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "openssl-1.0.1i-27.28.1.x86_64",
                "product": {
                  "name": "openssl-1.0.1i-27.28.1.x86_64",
                  "product_id": "openssl-1.0.1i-27.28.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12-LTSS",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12-LTSS",
                  "product_id": "SUSE Linux Enterprise Server 12-LTSS",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles-ltss:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-1.0.1i-27.28.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le"
        },
        "product_reference": "libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-1.0.1i-27.28.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x"
        },
        "product_reference": "libopenssl1_0_0-1.0.1i-27.28.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-1.0.1i-27.28.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64"
        },
        "product_reference": "libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x"
        },
        "product_reference": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64"
        },
        "product_reference": "libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le"
        },
        "product_reference": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x"
        },
        "product_reference": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64"
        },
        "product_reference": "libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x"
        },
        "product_reference": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64"
        },
        "product_reference": "libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1.0.1i-27.28.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le"
        },
        "product_reference": "openssl-1.0.1i-27.28.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1.0.1i-27.28.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x"
        },
        "product_reference": "openssl-1.0.1i-27.28.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-1.0.1i-27.28.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64"
        },
        "product_reference": "openssl-1.0.1i-27.28.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-doc-1.0.1i-27.28.1.noarch as component of SUSE Linux Enterprise Server 12-LTSS",
          "product_id": "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
        },
        "product_reference": "openssl-doc-1.0.1i-27.28.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-2108",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2108"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the \"negative zero\" issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2108",
          "url": "https://www.suse.com/security/cve/CVE-2016-2108"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1001502 for CVE-2016-2108",
          "url": "https://bugzilla.suse.com/1001502"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1004499 for CVE-2016-2108",
          "url": "https://bugzilla.suse.com/1004499"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005878 for CVE-2016-2108",
          "url": "https://bugzilla.suse.com/1005878"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1148697 for CVE-2016-2108",
          "url": "https://bugzilla.suse.com/1148697"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 977584 for CVE-2016-2108",
          "url": "https://bugzilla.suse.com/977584"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 977617 for CVE-2016-2108",
          "url": "https://bugzilla.suse.com/977617"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 978492 for CVE-2016-2108",
          "url": "https://bugzilla.suse.com/978492"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 989345 for CVE-2016-2108",
          "url": "https://bugzilla.suse.com/989345"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 996067 for CVE-2016-2108",
          "url": "https://bugzilla.suse.com/996067"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-16T12:36:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-2108"
    },
    {
      "cve": "CVE-2016-7056",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-7056"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-7056",
          "url": "https://www.suse.com/security/cve/CVE-2016-7056"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005878 for CVE-2016-7056",
          "url": "https://bugzilla.suse.com/1005878"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1019334 for CVE-2016-7056",
          "url": "https://bugzilla.suse.com/1019334"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1148697 for CVE-2016-7056",
          "url": "https://bugzilla.suse.com/1148697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-16T12:36:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-7056"
    },
    {
      "cve": "CVE-2016-8610",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-8610"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-8610",
          "url": "https://www.suse.com/security/cve/CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005878 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1005878"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005879 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1005879"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1110018 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1110018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1120592 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1120592"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1126909 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1126909"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1148697 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1148697"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 982575 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/982575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-16T12:36:33Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-8610"
    },
    {
      "cve": "CVE-2017-3731",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-3731"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-3731",
          "url": "https://www.suse.com/security/cve/CVE-2017-3731"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1021641 for CVE-2017-3731",
          "url": "https://bugzilla.suse.com/1021641"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1022085 for CVE-2017-3731",
          "url": "https://bugzilla.suse.com/1022085"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1064118 for CVE-2017-3731",
          "url": "https://bugzilla.suse.com/1064118"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1064119 for CVE-2017-3731",
          "url": "https://bugzilla.suse.com/1064119"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-16T12:36:33Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-3731"
    },
    {
      "cve": "CVE-2017-3735",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-3735"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
          "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-3735",
          "url": "https://www.suse.com/security/cve/CVE-2017-3735"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1056058 for CVE-2017-3735",
          "url": "https://bugzilla.suse.com/1056058"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.ppc64le",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.s390x",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-1.0.1i-27.28.1.x86_64",
            "SUSE Linux Enterprise Server 12-LTSS:openssl-doc-1.0.1i-27.28.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2018-01-16T12:36:33Z",
          "details": "low"
        }
      ],
      "title": "CVE-2017-3735"
    }
  ]
}

CVE-2016-8610 (GCVE-0-2016-8610)

Vulnerability from cvelistv5 – Published: 2017-11-13 22:00 – Updated: 2024-08-06 02:27

Summary

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

Severity ?

No CVSS data available.

CWE

CWE-400

Assigner

redhat

References

URL

Tags

	http://www.securityfocus.com/bid/93841	vdb-entryx_refsource_BID
	http://rhn.redhat.com/errata/RHSA-2017-1659.html	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:1658	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:1801	vendor-advisoryx_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2017-0286.html	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:1413	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2494	vendor-advisoryx_refsource_REDHAT
	https://security.FreeBSD.org/advisories/FreeBSD-S…	vendor-advisoryx_refsource_FREEBSD
	https://access.redhat.com/errata/RHSA-2017:1414	vendor-advisoryx_refsource_REDHAT
	http://seclists.org/oss-sec/2016/q4/224	mailing-listx_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2017-0574.html	vendor-advisoryx_refsource_REDHAT
	https://www.debian.org/security/2017/dsa-3773	vendor-advisoryx_refsource_DEBIAN
	http://rhn.redhat.com/errata/RHSA-2017-1415.html	vendor-advisoryx_refsource_REDHAT
	http://www.securitytracker.com/id/1037084	vdb-entryx_refsource_SECTRACK
	https://access.redhat.com/errata/RHSA-2017:1802	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2017:2493	vendor-advisoryx_refsource_REDHAT
	https://www.oracle.com/security-alerts/cpuapr2020.html	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC
	https://www.oracle.com/security-alerts/cpujan2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-2017113…	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
	https://git.openssl.org/gitweb/?p=openssl.git%3Ba…	x_refsource_CONFIRM
	https://security.360.cn/cve/CVE-2016-8610/	x_refsource_MISC
	https://support.hpe.com/hpsc/doc/public/display?d…	x_refsource_CONFIRM
	https://security.paloaltonetworks.com/CVE-2016-8610	x_refsource_CONFIRM
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Affected: All 0.9.8 Affected: All 1.0.1 Affected: 1.0.2 through 1.0.2h Affected: 1.1.0

Date Public ?

2016-10-24 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T02:27:40.949Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "93841",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/93841"
          },
          {
            "name": "RHSA-2017:1659",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-1659.html"
          },
          {
            "name": "RHSA-2017:1658",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1658"
          },
          {
            "name": "RHSA-2017:1801",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1801"
          },
          {
            "name": "RHSA-2017:0286",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0286.html"
          },
          {
            "name": "RHSA-2017:1413",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1413"
          },
          {
            "name": "RHSA-2017:2494",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2494"
          },
          {
            "name": "FreeBSD-SA-16:35",
            "tags": [
              "vendor-advisory",
              "x_refsource_FREEBSD",
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc"
          },
          {
            "name": "RHSA-2017:1414",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1414"
          },
          {
            "name": "[oss-security] 20161024 CVE-2016-8610: SSL Death Alert: OpenSSL SSL/TLS SSL3_AL_WARNING undefined alert Remote DoS",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://seclists.org/oss-sec/2016/q4/224"
          },
          {
            "name": "RHSA-2017:0574",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
          },
          {
            "name": "DSA-3773",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3773"
          },
          {
            "name": "RHSA-2017:1415",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-1415.html"
          },
          {
            "name": "1037084",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037084"
          },
          {
            "name": "RHSA-2017:1802",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1802"
          },
          {
            "name": "RHSA-2017:2493",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2493"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20171130-0001/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://security.360.cn/cve/CVE-2016-8610/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03897en_us"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2016-8610"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "All 0.9.8"
            },
            {
              "status": "affected",
              "version": "All 1.0.1"
            },
            {
              "status": "affected",
              "version": "1.0.2 through 1.0.2h"
            },
            {
              "status": "affected",
              "version": "1.1.0"
            }
          ]
        }
      ],
      "datePublic": "2016-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-20T21:14:51.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "93841",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/93841"
        },
        {
          "name": "RHSA-2017:1659",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-1659.html"
        },
        {
          "name": "RHSA-2017:1658",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1658"
        },
        {
          "name": "RHSA-2017:1801",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1801"
        },
        {
          "name": "RHSA-2017:0286",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0286.html"
        },
        {
          "name": "RHSA-2017:1413",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1413"
        },
        {
          "name": "RHSA-2017:2494",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2494"
        },
        {
          "name": "FreeBSD-SA-16:35",
          "tags": [
            "vendor-advisory",
            "x_refsource_FREEBSD"
          ],
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc"
        },
        {
          "name": "RHSA-2017:1414",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1414"
        },
        {
          "name": "[oss-security] 20161024 CVE-2016-8610: SSL Death Alert: OpenSSL SSL/TLS SSL3_AL_WARNING undefined alert Remote DoS",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://seclists.org/oss-sec/2016/q4/224"
        },
        {
          "name": "RHSA-2017:0574",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0574.html"
        },
        {
          "name": "DSA-3773",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3773"
        },
        {
          "name": "RHSA-2017:1415",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-1415.html"
        },
        {
          "name": "1037084",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037084"
        },
        {
          "name": "RHSA-2017:1802",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1802"
        },
        {
          "name": "RHSA-2017:2493",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2493"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2020.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujan2020.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20171130-0001/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://security.360.cn/cve/CVE-2016-8610/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03897en_us"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2016-8610"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-8610",
    "datePublished": "2017-11-13T22:00:00.000Z",
    "dateReserved": "2016-10-12T00:00:00.000Z",
    "dateUpdated": "2024-08-06T02:27:40.949Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-3735 (GCVE-0-2017-3735)

Vulnerability from cvelistv5 – Published: 2017-08-28 19:00 – Updated: 2024-09-16 21:08

Summary

While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.

Severity ?

No CVSS data available.

CWE

out of bounds read

Assigner

openssl

References

URL

Tags

	http://www.securitytracker.com/id/1039726	vdb-entry
	https://usn.ubuntu.com/3611-2/	vendor-advisory
	https://www.debian.org/security/2017/dsa-4018	vendor-advisory
	https://security.gentoo.org/glsa/201712-03	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2017…	mailing-list
	https://access.redhat.com/errata/RHSA-2018:3505	vendor-advisory
	https://www.debian.org/security/2017/dsa-4017	vendor-advisory
	https://access.redhat.com/errata/RHSA-2018:3221	vendor-advisory
	http://www.securityfocus.com/bid/100515	vdb-entry
	https://security.FreeBSD.org/advisories/FreeBSD-S…	vendor-advisory
	http://www.oracle.com/technetwork/security-adviso…
	http://www.oracle.com/technetwork/security-adviso…
	http://www.oracle.com/technetwork/security-adviso…
	http://www.oracle.com/technetwork/security-adviso…
	https://www.oracle.com/technetwork/security-advis…
	https://www.oracle.com/technetwork/security-advis…
	https://www.oracle.com/technetwork/security-advis…
	https://www.oracle.com//security-alerts/cpujul2021.html
	https://security.netapp.com/advisory/ntap-2017110…
	https://support.apple.com/HT208331
	https://github.com/openssl/openssl/commit/068b963…
	https://security.netapp.com/advisory/ntap-2017092…
	https://www.tenable.com/security/tns-2017-15
	https://www.openssl.org/news/secadv/20171102.txt
	https://www.tenable.com/security/tns-2017-14
	https://www.openssl.org/news/secadv/20170828.txt
	https://cert-portal.siemens.com/productcert/pdf/s…

Impacted products

	Vendor	Product	Version
	OpenSSL Software Foundation	OpenSSL	Affected: 1.1.0 Affected: 1.0.2

Date Public ?

2017-08-28 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:39:41.087Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1039726",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039726"
          },
          {
            "name": "USN-3611-2",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/3611-2/"
          },
          {
            "name": "DSA-4018",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-4018"
          },
          {
            "name": "GLSA-201712-03",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201712-03"
          },
          {
            "name": "[debian-lts-announce] 20171109 [SECURITY] [DLA-1157-1] openssl security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html"
          },
          {
            "name": "RHSA-2018:3505",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3505"
          },
          {
            "name": "DSA-4017",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-4017"
          },
          {
            "name": "RHSA-2018:3221",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:3221"
          },
          {
            "name": "100515",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100515"
          },
          {
            "name": "FreeBSD-SA-17:11",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20171107-0002/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/HT208331"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20170927-0001/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2017-15"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20171102.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2017-14"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20170828.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "1.1.0"
            },
            {
              "status": "affected",
              "version": "1.0.2"
            }
          ]
        }
      ],
      "datePublic": "2017-08-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "out of bounds read",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-13T00:00:00.000Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "1039726",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securitytracker.com/id/1039726"
        },
        {
          "name": "USN-3611-2",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/3611-2/"
        },
        {
          "name": "DSA-4018",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2017/dsa-4018"
        },
        {
          "name": "GLSA-201712-03",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201712-03"
        },
        {
          "name": "[debian-lts-announce] 20171109 [SECURITY] [DLA-1157-1] openssl security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html"
        },
        {
          "name": "RHSA-2018:3505",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3505"
        },
        {
          "name": "DSA-4017",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2017/dsa-4017"
        },
        {
          "name": "RHSA-2018:3221",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:3221"
        },
        {
          "name": "100515",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/100515"
        },
        {
          "name": "FreeBSD-SA-17:11",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc"
        },
        {
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html"
        },
        {
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
        },
        {
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html"
        },
        {
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
        },
        {
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html"
        },
        {
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        },
        {
          "url": "https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"
        },
        {
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20171107-0002/"
        },
        {
          "url": "https://support.apple.com/HT208331"
        },
        {
          "url": "https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20170927-0001/"
        },
        {
          "url": "https://www.tenable.com/security/tns-2017-15"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20171102.txt"
        },
        {
          "url": "https://www.tenable.com/security/tns-2017-14"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20170828.txt"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2017-3735",
    "datePublished": "2017-08-28T19:00:00.000Z",
    "dateReserved": "2016-12-16T00:00:00.000Z",
    "dateUpdated": "2024-09-16T21:08:28.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-7056 (GCVE-0-2016-7056)

Vulnerability from cvelistv5 – Published: 2018-09-10 16:00 – Updated: 2024-08-06 01:50

Summary

A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-385

Assigner

redhat

References

URL

Tags

	https://eprint.iacr.org/2016/1195	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2017:1801	vendor-advisoryx_refsource_REDHAT
	https://git.openssl.org/?p=openssl.git%3Ba=commit…	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:1413	vendor-advisoryx_refsource_REDHAT
	https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/c…	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037575	vdb-entryx_refsource_SECTRACK
	https://access.redhat.com/errata/RHSA-2017:1414	vendor-advisoryx_refsource_REDHAT
	https://seclists.org/oss-sec/2017/q1/52	mailing-listx_refsource_MLIST
	https://www.debian.org/security/2017/dsa-3773	vendor-advisoryx_refsource_DEBIAN
	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
	https://people.canonical.com/~ubuntu-security/cve…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/95375	vdb-entryx_refsource_BID
	http://rhn.redhat.com/errata/RHSA-2017-1415.html	vendor-advisoryx_refsource_REDHAT
	https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/c…	x_refsource_CONFIRM
	https://security-tracker.debian.org/tracker/CVE-2…	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2017:1802	vendor-advisoryx_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	The OpenSSL Project	openssl	Affected: openssl 1.0.1u

Date Public ?

2017-01-10 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T01:50:46.703Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://eprint.iacr.org/2016/1195"
          },
          {
            "name": "RHSA-2017:1801",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1801"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=8aed2a7548362e88e84a7feb795a3a97e8395008"
          },
          {
            "name": "RHSA-2017:1413",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1413"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig"
          },
          {
            "name": "1037575",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037575"
          },
          {
            "name": "RHSA-2017:1414",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1414"
          },
          {
            "name": "[oss-security] 20170110 CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://seclists.org/oss-sec/2017/q1/52"
          },
          {
            "name": "DSA-3773",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3773"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html"
          },
          {
            "name": "95375",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95375"
          },
          {
            "name": "RHSA-2017:1415",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-1415.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security-tracker.debian.org/tracker/CVE-2016-7056"
          },
          {
            "name": "RHSA-2017:1802",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1802"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openssl",
          "vendor": "The OpenSSL Project",
          "versions": [
            {
              "status": "affected",
              "version": "openssl 1.0.1u"
            }
          ]
        }
      ],
      "datePublic": "2017-01-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-385",
              "description": "CWE-385",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-11T20:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://eprint.iacr.org/2016/1195"
        },
        {
          "name": "RHSA-2017:1801",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1801"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=8aed2a7548362e88e84a7feb795a3a97e8395008"
        },
        {
          "name": "RHSA-2017:1413",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1413"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig"
        },
        {
          "name": "1037575",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037575"
        },
        {
          "name": "RHSA-2017:1414",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1414"
        },
        {
          "name": "[oss-security] 20170110 CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://seclists.org/oss-sec/2017/q1/52"
        },
        {
          "name": "DSA-3773",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3773"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html"
        },
        {
          "name": "95375",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95375"
        },
        {
          "name": "RHSA-2017:1415",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-1415.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security-tracker.debian.org/tracker/CVE-2016-7056"
        },
        {
          "name": "RHSA-2017:1802",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1802"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-7056",
    "datePublished": "2018-09-10T16:00:00.000Z",
    "dateReserved": "2016-08-23T00:00:00.000Z",
    "dateUpdated": "2024-08-06T01:50:46.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2016-2108 (GCVE-0-2016-2108)

Vulnerability from cvelistv5 – Published: 2016-05-05 00:00 – Updated: 2024-08-05 23:17

Summary

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.

Severity ?

No CVSS data available.

CWE

n/a

Assigner

redhat

References

URL

Tags

	http://www.slackware.com/security/viewer.php?l=sl…	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2016-2056.html	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2016-2073.html	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/displ…
	http://www.debian.org/security/2016/dsa-3566	vendor-advisory
	https://h20566.www2.hpe.com/hpsc/doc/public/displ…
	http://www.oracle.com/technetwork/topics/security…
	http://packetstormsecurity.com/files/136912/Slack…
	http://www.oracle.com/technetwork/security-adviso…
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	https://security.gentoo.org/glsa/201612-16	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	http://www.securitytracker.com/id/1035721	vdb-entry
	http://support.citrix.com/article/CTX212736
	https://git.openssl.org/?p=openssl.git%3Ba=commit…
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/publ…
	http://lists.fedoraproject.org/pipermail/package-…	vendor-advisory
	http://tools.cisco.com/security/center/content/Ci…	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	https://git.openssl.org/?p=openssl.git%3Ba=commit…
	https://h20566.www2.hpe.com/hpsc/doc/public/displ…
	http://www.oracle.com/technetwork/topics/security…
	http://lists.fedoraproject.org/pipermail/package-…	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	https://h20566.www2.hpe.com/portal/site/hpsc/publ…
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	http://lists.apple.com/archives/security-announce…	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	https://www.tenable.com/security/tns-2016-18
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	https://access.redhat.com/errata/RHSA-2017:0194	vendor-advisory
	http://source.android.com/security/bulletin/2016-…
	https://h20566.www2.hpe.com/portal/site/hpsc/publ…
	https://access.redhat.com/errata/RHSA-2017:0193	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	https://kb.pulsesecure.net/articles/Pulse_Securit…
	http://rhn.redhat.com/errata/RHSA-2016-0996.html	vendor-advisory
	https://security-center.intel.com/advisory.aspx?i…
	https://security.netapp.com/advisory/ntap-2016050…
	http://www.securityfocus.com/bid/91787	vdb-entry
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	http://lists.opensuse.org/opensuse-security-annou…	vendor-advisory
	http://rhn.redhat.com/errata/RHSA-2016-2957.html	vendor-advisory
	http://www.ubuntu.com/usn/USN-2959-1	vendor-advisory
	http://www.oracle.com/technetwork/security-adviso…
	http://rhn.redhat.com/errata/RHSA-2016-0722.html	vendor-advisory
	https://www.openssl.org/news/secadv/20160503.txt
	https://support.apple.com/HT206903
	https://bto.bluecoat.com/security-advisory/sa123
	http://www.securityfocus.com/bid/89752	vdb-entry
	http://lists.fedoraproject.org/pipermail/package-…	vendor-advisory
	https://access.redhat.com/errata/RHSA-2016:1137	vendor-advisory
	http://kb.juniper.net/InfoCenter/index?page=conte…
	https://cert-portal.siemens.com/productcert/pdf/s…

Date Public ?

2016-05-03 00:00

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:17:50.714Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SSA:2016-124-01",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.542103"
          },
          {
            "name": "RHSA-2016:2056",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2056.html"
          },
          {
            "name": "openSUSE-SU-2016:1238",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html"
          },
          {
            "name": "openSUSE-SU-2016:1242",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html"
          },
          {
            "name": "SUSE-SU-2016:1267",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html"
          },
          {
            "name": "RHSA-2016:2073",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2073.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03765en_us"
          },
          {
            "name": "DSA-3566",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2016/dsa-3566"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn03726en_us"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
          },
          {
            "name": "openSUSE-SU-2016:1243",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html"
          },
          {
            "name": "GLSA-201612-16",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201612-16"
          },
          {
            "name": "SUSE-SU-2016:1228",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html"
          },
          {
            "name": "1035721",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1035721"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://support.citrix.com/article/CTX212736"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27"
          },
          {
            "name": "openSUSE-SU-2016:1239",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html"
          },
          {
            "name": "SUSE-SU-2016:1206",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345"
          },
          {
            "name": "FEDORA-2016-1e39d934ed",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html"
          },
          {
            "name": "20160504 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl"
          },
          {
            "name": "SUSE-SU-2016:1231",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3661bb4e7934668bd99ca777ea8b30eedfafa871"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03756en_us"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
          },
          {
            "name": "FEDORA-2016-1411324654",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html"
          },
          {
            "name": "openSUSE-SU-2016:1240",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862"
          },
          {
            "name": "openSUSE-SU-2016:1241",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html"
          },
          {
            "name": "APPLE-SA-2016-07-18-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"
          },
          {
            "name": "SUSE-SU-2016:1360",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2016-18"
          },
          {
            "name": "SUSE-SU-2016:1233",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html"
          },
          {
            "name": "RHSA-2017:0194",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0194"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://source.android.com/security/bulletin/2016-07-01.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804"
          },
          {
            "name": "RHSA-2017:0193",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:0193"
          },
          {
            "name": "openSUSE-SU-2016:1237",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202"
          },
          {
            "name": "RHSA-2016:0996",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0996.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067\u0026languageid=en-fr"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20160504-0001/"
          },
          {
            "name": "91787",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/91787"
          },
          {
            "name": "SUSE-SU-2016:1290",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html"
          },
          {
            "name": "openSUSE-SU-2016:1273",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html"
          },
          {
            "name": "RHSA-2016:2957",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2957.html"
          },
          {
            "name": "USN-2959-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2959-1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
          },
          {
            "name": "RHSA-2016:0722",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2016-0722.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20160503.txt"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://support.apple.com/HT206903"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://bto.bluecoat.com/security-advisory/sa123"
          },
          {
            "name": "89752",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/89752"
          },
          {
            "name": "FEDORA-2016-05c567df1a",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html"
          },
          {
            "name": "RHSA-2016:1137",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2016:1137"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10759"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-05-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the \"negative zero\" issue."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-12-13T00:00:00.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "SSA:2016-124-01",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.542103"
        },
        {
          "name": "RHSA-2016:2056",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2056.html"
        },
        {
          "name": "openSUSE-SU-2016:1238",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html"
        },
        {
          "name": "openSUSE-SU-2016:1242",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html"
        },
        {
          "name": "SUSE-SU-2016:1267",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html"
        },
        {
          "name": "RHSA-2016:2073",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2073.html"
        },
        {
          "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03765en_us"
        },
        {
          "name": "DSA-3566",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.debian.org/security/2016/dsa-3566"
        },
        {
          "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn03726en_us"
        },
        {
          "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"
        },
        {
          "url": "http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html"
        },
        {
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html"
        },
        {
          "name": "openSUSE-SU-2016:1243",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html"
        },
        {
          "name": "GLSA-201612-16",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/201612-16"
        },
        {
          "name": "SUSE-SU-2016:1228",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html"
        },
        {
          "name": "1035721",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securitytracker.com/id/1035721"
        },
        {
          "url": "http://support.citrix.com/article/CTX212736"
        },
        {
          "url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=f5da52e308a6aeea6d5f3df98c4da295d7e9cc27"
        },
        {
          "name": "openSUSE-SU-2016:1239",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html"
        },
        {
          "name": "SUSE-SU-2016:1206",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html"
        },
        {
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05149345"
        },
        {
          "name": "FEDORA-2016-1e39d934ed",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html"
        },
        {
          "name": "20160504 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl"
        },
        {
          "name": "SUSE-SU-2016:1231",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html"
        },
        {
          "url": "https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=3661bb4e7934668bd99ca777ea8b30eedfafa871"
        },
        {
          "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03756en_us"
        },
        {
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
        },
        {
          "name": "FEDORA-2016-1411324654",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html"
        },
        {
          "name": "openSUSE-SU-2016:1240",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html"
        },
        {
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862"
        },
        {
          "name": "openSUSE-SU-2016:1241",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html"
        },
        {
          "name": "APPLE-SA-2016-07-18-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html"
        },
        {
          "name": "SUSE-SU-2016:1360",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html"
        },
        {
          "url": "https://www.tenable.com/security/tns-2016-18"
        },
        {
          "name": "SUSE-SU-2016:1233",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html"
        },
        {
          "name": "RHSA-2017:0194",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0194"
        },
        {
          "url": "http://source.android.com/security/bulletin/2016-07-01.html"
        },
        {
          "url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05386804"
        },
        {
          "name": "RHSA-2017:0193",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:0193"
        },
        {
          "name": "openSUSE-SU-2016:1237",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html"
        },
        {
          "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40202"
        },
        {
          "name": "RHSA-2016:0996",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0996.html"
        },
        {
          "url": "https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00067\u0026languageid=en-fr"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20160504-0001/"
        },
        {
          "name": "91787",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/91787"
        },
        {
          "name": "SUSE-SU-2016:1290",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html"
        },
        {
          "name": "openSUSE-SU-2016:1273",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html"
        },
        {
          "name": "RHSA-2016:2957",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-2957.html"
        },
        {
          "name": "USN-2959-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2959-1"
        },
        {
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
        },
        {
          "name": "RHSA-2016:0722",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2016-0722.html"
        },
        {
          "url": "https://www.openssl.org/news/secadv/20160503.txt"
        },
        {
          "url": "https://support.apple.com/HT206903"
        },
        {
          "url": "https://bto.bluecoat.com/security-advisory/sa123"
        },
        {
          "name": "89752",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/89752"
        },
        {
          "name": "FEDORA-2016-05c567df1a",
          "tags": [
            "vendor-advisory"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html"
        },
        {
          "name": "RHSA-2016:1137",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2016:1137"
        },
        {
          "url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10759"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-2108",
    "datePublished": "2016-05-05T00:00:00.000Z",
    "dateReserved": "2016-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-05T23:17:50.714Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-3731 (GCVE-0-2017-3731)

Vulnerability from cvelistv5 – Published: 2017-05-04 19:00 – Updated: 2024-09-16 22:40

Title

Truncated packet could crash via OOB read

Summary

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.

Severity ?

No CVSS data available.

CWE

out-of-bounds read

Assigner

openssl

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2018:2185	vendor-advisoryx_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2018:2186	vendor-advisoryx_refsource_REDHAT
	https://security.netapp.com/advisory/ntap-2017101…	x_refsource_CONFIRM
	http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/95813	vdb-entryx_refsource_BID
	http://rhn.redhat.com/errata/RHSA-2017-0286.html	vendor-advisoryx_refsource_REDHAT
	https://security.FreeBSD.org/advisories/FreeBSD-S…	vendor-advisoryx_refsource_FREEBSD
	https://www.openssl.org/news/secadv/20170126.txt	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1037717	vdb-entryx_refsource_SECTRACK
	http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
	https://www.tenable.com/security/tns-2017-04	x_refsource_CONFIRM
	https://source.android.com/security/bulletin/pixe…	x_refsource_CONFIRM
	https://security.gentoo.org/glsa/201702-07	vendor-advisoryx_refsource_GENTOO
	http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
	http://www.debian.org/security/2017/dsa-3773	vendor-advisoryx_refsource_DEBIAN
	https://support.hpe.com/hpsc/doc/public/display?d…	x_refsource_CONFIRM
	https://access.redhat.com/errata/RHSA-2018:2187	vendor-advisoryx_refsource_REDHAT
	https://github.com/openssl/openssl/commit/00d9654…	x_refsource_MISC
	https://www.oracle.com/technetwork/security-advis…	x_refsource_MISC
	https://security.paloaltonetworks.com/CVE-2017-3731	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	OpenSSL	OpenSSL	Affected: openssl-1.1.0 Affected: openssl-1.1.0a Affected: openssl-1.1.0b Affected: openssl-1.1.0c Affected: openssl-1.0.2 Affected: openssl-1.0.2a Affected: openssl-1.0.2b Affected: openssl-1.0.2c Affected: openssl-1.0.2d Affected: openssl-1.0.2e Affected: openssl-1.0.2f Affected: openssl-1.0.2g Affected: openssl-1.0.2h Affected: openssl-1.0.2i Affected: openssl-1.0.2j

Date Public ?

2017-01-26 00:00

Credits

Robert Święcki of Google

Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:39:40.936Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2018:2185",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2185"
          },
          {
            "name": "RHSA-2018:2186",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2186"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20171019-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
          },
          {
            "name": "95813",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/95813"
          },
          {
            "name": "RHSA-2017:0286",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2017-0286.html"
          },
          {
            "name": "FreeBSD-SA-17:02",
            "tags": [
              "vendor-advisory",
              "x_refsource_FREEBSD",
              "x_transferred"
            ],
            "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20170126.txt"
          },
          {
            "name": "1037717",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037717"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.tenable.com/security/tns-2017-04"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://source.android.com/security/bulletin/pixel/2017-11-01"
          },
          {
            "name": "GLSA-201702-07",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201702-07"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
          },
          {
            "name": "DSA-3773",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2017/dsa-3773"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03838en_us"
          },
          {
            "name": "RHSA-2018:2187",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:2187"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.paloaltonetworks.com/CVE-2017-3731"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "openssl-1.1.0"
            },
            {
              "status": "affected",
              "version": "openssl-1.1.0a"
            },
            {
              "status": "affected",
              "version": "openssl-1.1.0b"
            },
            {
              "status": "affected",
              "version": "openssl-1.1.0c"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2a"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2b"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2c"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2d"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2e"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2f"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2g"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2h"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2i"
            },
            {
              "status": "affected",
              "version": "openssl-1.0.2j"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Robert \u015awi\u0119cki of Google"
        }
      ],
      "datePublic": "2017-01-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#Moderate",
              "value": "Moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "out-of-bounds read",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-17T16:03:45.000Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "name": "RHSA-2018:2185",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2185"
        },
        {
          "name": "RHSA-2018:2186",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2186"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20171019-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
        },
        {
          "name": "95813",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/95813"
        },
        {
          "name": "RHSA-2017:0286",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2017-0286.html"
        },
        {
          "name": "FreeBSD-SA-17:02",
          "tags": [
            "vendor-advisory",
            "x_refsource_FREEBSD"
          ],
          "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.openssl.org/news/secadv/20170126.txt"
        },
        {
          "name": "1037717",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037717"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.tenable.com/security/tns-2017-04"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://source.android.com/security/bulletin/pixel/2017-11-01"
        },
        {
          "name": "GLSA-201702-07",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201702-07"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
        },
        {
          "name": "DSA-3773",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2017/dsa-3773"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03838en_us"
        },
        {
          "name": "RHSA-2018:2187",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:2187"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.paloaltonetworks.com/CVE-2017-3731"
        }
      ],
      "title": "Truncated packet could crash via OOB read",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "openssl-security@openssl.org",
          "DATE_PUBLIC": "2017-01-26",
          "ID": "CVE-2017-3731",
          "STATE": "PUBLIC",
          "TITLE": "Truncated packet could crash via OOB read"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "OpenSSL",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "openssl-1.1.0"
                          },
                          {
                            "version_value": "openssl-1.1.0a"
                          },
                          {
                            "version_value": "openssl-1.1.0b"
                          },
                          {
                            "version_value": "openssl-1.1.0c"
                          },
                          {
                            "version_value": "openssl-1.0.2"
                          },
                          {
                            "version_value": "openssl-1.0.2a"
                          },
                          {
                            "version_value": "openssl-1.0.2b"
                          },
                          {
                            "version_value": "openssl-1.0.2c"
                          },
                          {
                            "version_value": "openssl-1.0.2d"
                          },
                          {
                            "version_value": "openssl-1.0.2e"
                          },
                          {
                            "version_value": "openssl-1.0.2f"
                          },
                          {
                            "version_value": "openssl-1.0.2g"
                          },
                          {
                            "version_value": "openssl-1.0.2h"
                          },
                          {
                            "version_value": "openssl-1.0.2i"
                          },
                          {
                            "version_value": "openssl-1.0.2j"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "OpenSSL"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Robert \u015awi\u0119cki of Google"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k."
            }
          ]
        },
        "impact": [
          {
            "lang": "eng",
            "url": "https://www.openssl.org/policies/secpolicy.html#Moderate",
            "value": "Moderate"
          }
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "out-of-bounds read"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2018:2185",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2185"
            },
            {
              "name": "RHSA-2018:2186",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2186"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20171019-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20171019-0002/"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
            },
            {
              "name": "95813",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/95813"
            },
            {
              "name": "RHSA-2017:0286",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2017-0286.html"
            },
            {
              "name": "FreeBSD-SA-17:02",
              "refsource": "FREEBSD",
              "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc"
            },
            {
              "name": "https://www.openssl.org/news/secadv/20170126.txt",
              "refsource": "CONFIRM",
              "url": "https://www.openssl.org/news/secadv/20170126.txt"
            },
            {
              "name": "1037717",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037717"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
            },
            {
              "name": "https://www.tenable.com/security/tns-2017-04",
              "refsource": "CONFIRM",
              "url": "https://www.tenable.com/security/tns-2017-04"
            },
            {
              "name": "https://source.android.com/security/bulletin/pixel/2017-11-01",
              "refsource": "CONFIRM",
              "url": "https://source.android.com/security/bulletin/pixel/2017-11-01"
            },
            {
              "name": "GLSA-201702-07",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201702-07"
            },
            {
              "name": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
            },
            {
              "name": "DSA-3773",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2017/dsa-3773"
            },
            {
              "name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03838en_us",
              "refsource": "CONFIRM",
              "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03838en_us"
            },
            {
              "name": "RHSA-2018:2187",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2018:2187"
            },
            {
              "name": "https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21",
              "refsource": "MISC",
              "url": "https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21"
            },
            {
              "name": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
            },
            {
              "name": "https://security.paloaltonetworks.com/CVE-2017-3731",
              "refsource": "CONFIRM",
              "url": "https://security.paloaltonetworks.com/CVE-2017-3731"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2017-3731",
    "datePublished": "2017-05-04T19:00:00.000Z",
    "dateReserved": "2016-12-16T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:40:54.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.