CVE-2017-3731
04.05.2017, 19:29
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openssl | openssl | 1.1.0a:a |
| openssl | openssl | 1.1.0b:b |
| openssl | openssl | 1.1.0c:c |
| openssl | openssl | 1.0.2 |
| openssl | openssl | 1.0.2:beta1 |
| openssl | openssl | 1.0.2:beta2 |
| openssl | openssl | 1.0.2:beta3 |
| openssl | openssl | 1.0.2a:a |
| openssl | openssl | 1.0.2b:b |
| openssl | openssl | 1.0.2c:c |
| openssl | openssl | 1.0.2d:d |
| openssl | openssl | 1.0.2e:e |
| openssl | openssl | 1.0.2f:f |
| openssl | openssl | 1.0.2h:h |
| openssl | openssl | 1.0.2i:i |
| openssl | openssl | 1.0.2j:j |
| nodejs | node.js | 4.0.0 ≤ 𝑥 ≤ 4.1.2 |
| nodejs | node.js | 4.2.0 ≤ 𝑥 < 4.7.3 |
| nodejs | node.js | 5.0.0 ≤ 𝑥 ≤ 5.12.0 |
| nodejs | node.js | 6.0.0 ≤ 𝑥 ≤ 6.8.1 |
| nodejs | node.js | 6.9.0 ≤ 𝑥 < 6.9.5 |
| nodejs | node.js | 7.0.0 ≤ 𝑥 < 7.5.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| openssl |
| ||||||||||||||||||
| openssl098 |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libopenssl-devel |
| ||||||||||||||||
| libopenssl-fips-provider |
| ||||||||||||||||
| nodejs4 |
| ||||||||||||||||
| nodejs4-devel |
| ||||||||||||||||
| nodejs4-docs |
| ||||||||||||||||
| nodejs6 |
| ||||||||||||||||
| nodejs6-devel |
| ||||||||||||||||
| nodejs6-docs |
| ||||||||||||||||
| npm4 |
| ||||||||||||||||
| npm6 |
| ||||||||||||||||
| openssl |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||||
|---|---|---|---|---|---|
| openssl |
| ||||
| openssl-devel |
| ||||
| openssl-libs |
| ||||
| openssl-perl |
| ||||
| openssl-static |
|
Common Weakness Enumeration
References