7.5
CVSSv3

CVE-2018-0732

Published: 12/06/2018 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

openssl openssl

debian debian linux 8.0

canonical ubuntu linux 16.04

canonical ubuntu linux 14.04

canonical ubuntu linux 12.04

canonical ubuntu linux 17.10

canonical ubuntu linux 18.04

nodejs node.js

Vendor Advisories

Several security issues were fixed in OpenSSL ...
Several security issues were fixed in OpenSSL ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2429 SP2 security update Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services Pack Apache Server 2429 Service Pack 2 zip release for RHEL 6 and RHEL 7 is availableRed Hat Product Security has rated this release a ...
Synopsis Moderate: Red Hat OpenShift Application Runtimes Nodejs 8114 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Application RuntimesRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vuln ...
Synopsis Moderate: Red Hat OpenShift Application Runtimes Nodejs 1090 security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Application RuntimesRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vuln ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2429 SP2 security update Type/Severity Security Advisory: Important Topic An update is now available for JBoss Core Services on RHEL 6 and RHEL 7Red Hat Product Security has rated this update as having a security impact of Important A Co ...
Synopsis Critical: Red Hat Ansible Tower 331-2 Release - Container Image Type/Severity Security Advisory: Critical Topic Security Advisory Description Red Hat Ansible Tower 331 is now available and contains the following bug fixes: Fixed event callback error when in-line vaulted variabl ...
Synopsis Moderate: openssl security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for openssl is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring Sy ...
Synopsis Important: Red Hat JBoss Core Services Apache HTTP Server 2429 SP2 security update Type/Severity Security Advisory: Important Topic Red Hat JBoss Core Services Pack Apache Server 2429 Service Pack 2 packages for Microsoft Windows and Oracle Solaris are now availableRed Hat Product Security has ...
Several local side channel attacks and a denial of service via large Diffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets Layer toolkit For the stable distribution (stretch), these problems have been fixed in version 102q-1~deb9u1 Going forward, openssl10 security updates for stretch will be based on the 102x upstream relea ...
Several local side channel attacks and a denial of service via large Diffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets Layer toolkit For the stable distribution (stretch), these problems have been fixed in version 110j-1~deb9u1 Going forward, openssl security updates for stretch will be based on the 110x upstream releases ...
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished This could be exploited in a Denial Of Service attack( ...
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished This could be exploited in a Denial Of Service attack( ...
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished This could be exploited in a Denial Of Service attack ...
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished This could be exploited in a Denial Of Service attack ...
ProductsSolutionsSupport and ServicesCompanyHow To BuySupport PortalGo To PortalRegisterForgot Username/Password?English日本語中文</form> {"@context":"schemaorg/","@type":"BreadcrumbList","url":"wwwbroadcomcom/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-627","numberOfItems":5,"itemLis ...
Log Correlation Engine leverages third-party software to help provide underlying functionality One third-party component (OpenSSL) was found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled libraries to address the potent ...
Nessus leverages third-party software to help provide underlying functionality One third-party component (OpenSSL) was found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled libraries to address the potential impact of th ...
Nessus leverages third-party software to help provide underlying functionality One third-party component (OpenSSL) was found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled libraries to address the potential impact of th ...
SecurityCenter leverages third-party software to help provide underlying functionality Two separate third-party components (PHP and OpenSSL) were found to contain vulnerabilities, and updated versions have been made available by the providers Out of caution and in line with good practice, Tenable opted to upgrade the bundled libraries to address ...

References

CWE-320https://www.openssl.org/news/secadv/20180612.txthttp://www.securitytracker.com/id/1041090http://www.securityfocus.com/bid/104442https://usn.ubuntu.com/3692-2/https://usn.ubuntu.com/3692-1/https://lists.debian.org/debian-lts-announce/2018/07/msg00043.htmlhttps://access.redhat.com/errata/RHSA-2018:2553https://access.redhat.com/errata/RHSA-2018:2552https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/https://www.tenable.com/security/tns-2018-12https://securityadvisories.paloaltonetworks.com/Home/Detail/133http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlhttps://www.tenable.com/security/tns-2018-14https://www.tenable.com/security/tns-2018-13https://access.redhat.com/errata/RHSA-2018:3221https://security.netapp.com/advisory/ntap-20181105-0001/https://access.redhat.com/errata/RHSA-2018:3505https://security.gentoo.org/glsa/201811-03https://www.debian.org/security/2018/dsa-4348https://www.debian.org/security/2018/dsa-4355https://www.tenable.com/security/tns-2018-17https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://security.netapp.com/advisory/ntap-20190118-0002/https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlhttps://access.redhat.com/errata/RHSA-2019:1297https://access.redhat.com/errata/RHSA-2019:1296https://access.redhat.com/errata/RHSA-2019:1543https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujan2021.htmlhttps://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdfhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4https://nvd.nist.govhttps://usn.ubuntu.com/3692-1/