CVE-2017-3731 Truncated packet could crash via OOB read
HighCVSS 7.5
EPSS 57.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssl(Debian:12) | < 1.1.0d-1 | 1.1.0d-1 |
| debian/openssl(Debian:13) | < 1.1.0d-1 | 1.1.0d-1 |
| debian/openssl(Debian:14) | < 1.1.0d-1 | 1.1.0d-1 |
| OpenSSL | = 1.1.0a | No fix listed |
| OpenSSL | = 1.1.0b | No fix listed |
| OpenSSL | = 1.1.0c | No fix listed |
| OpenSSL | = 1.0.2 | No fix listed |
| OpenSSL | = 1.0.2-beta1 | No fix listed |
| OpenSSL | = 1.0.2-beta2 | No fix listed |
| OpenSSL | = 1.0.2-beta3 | No fix listed |
| OpenSSL | = 1.0.2a | No fix listed |
| OpenSSL | = 1.0.2b | No fix listed |
| OpenSSL | = 1.0.2c | No fix listed |
| OpenSSL | = 1.0.2d | No fix listed |
| OpenSSL | = 1.0.2e | No fix listed |
| OpenSSL | = 1.0.2f | No fix listed |
| OpenSSL | = 1.0.2h | No fix listed |
| OpenSSL | = 1.0.2i | No fix listed |
| OpenSSL | = 1.0.2j | No fix listed |
| nodejs node.js | >= 4.0.0, <= 4.1.2 | No fix listed |
| nodejs node.js | >= 4.2.0, < 4.7.3 | 4.7.3 |
| nodejs node.js | >= 5.0.0, <= 5.12.0 | No fix listed |
| nodejs node.js | >= 6.0.0, <= 6.8.1 | No fix listed |
| nodejs node.js | >= 6.9.0, < 6.9.5 | 6.9.5 |
| nodejs node.js | >= 7.0.0, < 7.5.0 | 7.5.0 |
Show 18 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/openssl(Alpine:v3.2) | < 1.0.2k-r0 | 1.0.2k-r0 |
| alpine/openssl(Alpine:v3.3) | < 1.0.2k-r0 | 1.0.2k-r0 |
| alpine/openssl(Alpine:v3.4) | < 1.0.2k-r0 | 1.0.2k-r0 |
| OpenSSL | = openssl-1.1.0 | No fix listed |
| OpenSSL | = openssl-1.1.0a | No fix listed |
| OpenSSL | = openssl-1.1.0b | No fix listed |
| OpenSSL | = openssl-1.1.0c | No fix listed |
| OpenSSL | = openssl-1.0.2 | No fix listed |
| OpenSSL | = openssl-1.0.2a | No fix listed |
| OpenSSL | = openssl-1.0.2b | No fix listed |
| OpenSSL | = openssl-1.0.2c | No fix listed |
| OpenSSL | = openssl-1.0.2d | No fix listed |
| OpenSSL | = openssl-1.0.2e | No fix listed |
| OpenSSL | = openssl-1.0.2f | No fix listed |
| OpenSSL | = openssl-1.0.2g | No fix listed |
| OpenSSL | = openssl-1.0.2h | No fix listed |
| OpenSSL | = openssl-1.0.2i | No fix listed |
| OpenSSL | = openssl-1.0.2j | No fix listed |
References
- Debian Security Tracker CVE-2017-3731 vendor-advisory
- RHSA-2017:0286 third-party-advisory vendor-advisory
- DSA-3773 third-party-advisory vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com patch third-party-advisory
- 95813 third-party-advisory vdb-entry
- 1037717 third-party-advisory vdb-entry
- RHSA-2018:2185 third-party-advisory vendor-advisory
- RHSA-2018:2186 third-party-advisory vendor-advisory
- RHSA-2018:2187 third-party-advisory vendor-advisory
- github.com third-party-advisory
- FreeBSD-SA-17:02 third-party-advisory vendor-advisory
- GLSA-201702-07 third-party-advisory vendor-advisory
- security.netapp.com third-party-advisory
- security.paloaltonetworks.com third-party-advisory
- source.android.com third-party-advisory
- support.hpe.com third-party-advisory
- www.openssl.org vendor-advisory
- www.oracle.com patch third-party-advisory
- www.tenable.com third-party-advisory
- security.alpinelinux.org vendor-advisory