CVE-2018-0739
27.03.2018, 21:29
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| openssl | openssl | 1.0.2b ≤ 𝑥 ≤ 1.0.2n |
| openssl | openssl | 1.1.0 ≤ 𝑥 ≤ 1.1.0g |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 17.10 |
| debian | debian_linux | 7.0 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| libtomcrypt |
| ||||||||||||||||
| openssl |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| openssl |
| ||||||||||||
| openssl098 |
| ||||||||||||
| openssl1.0 |
|
openSUSE / SLES Releases
openSUSE Product | |||||
|---|---|---|---|---|---|
| ovmf-201911 |
| ||||
| ovmf-202008 |
| ||||
| ovmf-202202 |
| ||||
| ovmf-202408 |
| ||||
| ovmf-tools-201911 |
| ||||
| ovmf-tools-202008 |
| ||||
| ovmf-tools-202202 |
| ||||
| ovmf-tools-202408 |
| ||||
| qemu-ovmf-x86_64-201911 |
| ||||
| qemu-ovmf-x86_64-202008 |
| ||||
| qemu-ovmf-x86_64-202202 |
| ||||
| qemu-ovmf-x86_64-202408 |
| ||||
| qemu-uefi-aarch64-201911 |
| ||||
| qemu-uefi-aarch64-202008 |
| ||||
| qemu-uefi-aarch64-202202 |
| ||||
| qemu-uefi-aarch64-202408 |
|
Red Hat Enterprise Linux Releases
Red Hat Product | |||
|---|---|---|---|
| AAVMF |
| ||
| OVMF |
| ||
| openssl |
| ||
| openssl-devel |
| ||
| openssl-libs |
| ||
| openssl-perl |
| ||
| openssl-static |
|
Common Weakness Enumeration
References