CVE-2017-3733 Encrypt-Then-Mac renegotiation crash
HighCVSS 7.5
EPSS 12.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssl(Debian:12) | < 1.1.0e-1 | 1.1.0e-1 |
| debian/openssl(Debian:13) | < 1.1.0e-1 | 1.1.0e-1 |
| debian/openssl(Debian:14) | < 1.1.0e-1 | 1.1.0e-1 |
| OpenSSL | = 1.1.0 | No fix listed |
| OpenSSL | = 1.1.0a | No fix listed |
| OpenSSL | = 1.1.0b | No fix listed |
| OpenSSL | = 1.1.0c | No fix listed |
| OpenSSL | = 1.1.0d | No fix listed |
| HP Inc operations agent | = 11.14 | No fix listed |
| HP Inc operations agent | = 11.15 | No fix listed |
| OpenSSL | = openssl-1.1.0 | No fix listed |
| OpenSSL | = openssl-1.1.0a | No fix listed |
| OpenSSL | = openssl-1.1.0b | No fix listed |
| OpenSSL | = openssl-1.1.0c | No fix listed |
| OpenSSL | = openssl-1.1.0d | No fix listed |
References
- Debian Security Tracker CVE-2017-3733 vendor-advisory
- www.oracle.com
- www.oracle.com
- 96269 third-party-advisory vdb-entry
- 1037846 vdb-entry
- github.com
- h20566.www2.hpe.com third-party-advisory vdb-entry
- www.openssl.org vendor-advisory
- www.oracle.com