CVE-2018-0737 Cache timing vulnerability in RSA Key Generation
MediumCVSS 5.9
EPSS 11.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/openssl(Debian:12) | < 1.1.0h-3 | 1.1.0h-3 |
| debian/openssl(Debian:13) | < 1.1.0h-3 | 1.1.0h-3 |
| debian/openssl(Debian:14) | < 1.1.0h-3 | 1.1.0h-3 |
| alpine/openssl(Alpine:v3.3) | >= 1.0.2b, < 1.0.2o-r1 | 1.0.2o-r1 |
| alpine/openssl(Alpine:v3.4) | >= 1.0.2b, < 1.0.2o-r2 | 1.0.2o-r2 |
| alpine/openssl(Alpine:v3.5) | >= 1.0.2b, < 1.0.2o-r1 | 1.0.2o-r1 |
| alpine/openssl(Alpine:v3.6) | >= 1.0.2b, < 1.0.2o-r1 | 1.0.2o-r1 |
| alpine/openssl(Alpine:v3.7) | >= 1.0.2b, < 1.0.2o-r1 | 1.0.2o-r1 |
| alpine/openssl(Alpine:v3.8) | >= 1.0.2b, < 1.0.2o-r2 | 1.0.2o-r2 |
| OpenSSL | = Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h) | No fix listed |
| OpenSSL | = Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o) | No fix listed |
| OpenSSL | >= 1.0.2b, <= 1.0.2o | No fix listed |
| OpenSSL | >= 1.1.0, <= 1.1.0h | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
References
- Debian Security Tracker CVE-2018-0737 vendor-advisory
- security.alpinelinux.org vendor-advisory
- [debian-lts-announce] 20180728 [SECURITY] [DLA 1449-1] openssl security update mailing-list
- DSA-4355 vendor-advisory
- USN-3628-2 third-party-advisory vendor-advisory
- GLSA-201811-21 vendor-advisory
- USN-3692-2 vendor-advisory
- RHSA-2018:3505 vendor-advisory
- 103766 third-party-advisory vdb-entry
- USN-3692-1 vendor-advisory
- RHSA-2018:3221 vendor-advisory
- DSA-4348 vendor-advisory
- 1040685 third-party-advisory vdb-entry
- USN-3628-1 third-party-advisory vendor-advisory
- FEDORA-2019-db06efdea1 vendor-advisory
- FEDORA-2019-00c25b9379 vendor-advisory
- FEDORA-2019-9a0a7c0986 vendor-advisory
- RHSA-2019:3933 vendor-advisory
- RHSA-2019:3935 vendor-advisory
- RHSA-2019:3932 vendor-advisory
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.tenable.com
- securityadvisories.paloaltonetworks.com
- www.tenable.com
- www.tenable.com
- www.tenable.com
- nodejs.org
- www.oracle.com
- git.openssl.org
- git.openssl.org
- www.openssl.org vendor-advisory
- security.netapp.com
- bugs.debian.org issue-tracking