Published: 04/05/2017 Updated: 23/04/2019

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 prior to 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openssl openssl 1.1.0
openssl openssl 1.1.0c
openssl openssl 1.1.0d
openssl openssl 1.1.0a
openssl openssl 1.1.0b
hp operations agent 11.15
hp operations agent 11.14

It was found that changing the ciphersuite during a renegotiation of the Encrypt-Then-Mac extension could result in a crash of the OpenSSL server or client ...

On January 26, 2017, the OpenSSL Software Foundation released a security advisory that included three new vulnerabilities The foundation also released one vulnerability that was already disclosed in the OpenSSL advisory for November 2016 and included in the Cisco Security Advisory Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: Novem ...

a basic ruby command like to check cvedetails for details on a given product

CveDetailsClient Usage After checking out the repo run bundle install You can then run the cvetest client using bundle exec bin/cve_details_client product dataFile [toEmail] [fromEmail] If the dataFile is blank it will check for vulnerabilities from the current day which there may not be any of - create one with content like: { "cve_id": "CVE-2017-3733&quo

CWE-20 https://www.openssl.org/news/secadv/20170216.txt http://www.securityfocus.com/bid/96269 https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03728en_us http://www.securitytracker.com/id/1037846 http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2 https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html https://nvd.nist.gov https://github.com/scarby/cve_details_client https://access.redhat.com/security/cve/cve-2017-3733

CVE-2017-3733

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect