CVE-2018-0739 Constructed ASN.1 types with a recursive definition could exceed the stack
MediumCVSS 6.5
EPSS 18.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libtomcrypt(Debian:12) | < 1.18.2-1 | 1.18.2-1 |
| debian/libtomcrypt(Debian:13) | < 1.18.2-1 | 1.18.2-1 |
| debian/libtomcrypt(Debian:14) | < 1.18.2-1 | 1.18.2-1 |
| debian/openssl(Debian:12) | < 1.1.0h-1 | 1.1.0h-1 |
| debian/openssl(Debian:13) | < 1.1.0h-1 | 1.1.0h-1 |
| debian/openssl(Debian:14) | < 1.1.0h-1 | 1.1.0h-1 |
| OpenSSL | >= 1.0.2b, <= 1.0.2n | No fix listed |
| OpenSSL | >= 1.1.0, <= 1.1.0g | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| alpine/openssl(Alpine:v3.3) | >= 1.0.2b, < 1.0.2o-r0 | 1.0.2o-r0 |
| alpine/openssl(Alpine:v3.4) | >= 1.0.2b, < 1.0.2o-r0 | 1.0.2o-r0 |
| alpine/openssl(Alpine:v3.5) | >= 1.0.2b, < 1.0.2o-r0 | 1.0.2o-r0 |
| alpine/openssl(Alpine:v3.6) | >= 1.0.2b, < 1.0.2o-r0 | 1.0.2o-r0 |
| alpine/openssl(Alpine:v3.7) | >= 1.0.2b, < 1.0.2o-r0 | 1.0.2o-r0 |
| alpine/openssl(Alpine:v3.8) | >= 1.0.2b, < 1.0.2o-r0 | 1.0.2o-r0 |
| OpenSSL | = Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g) | No fix listed |
| OpenSSL | = Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n) | No fix listed |
References
- Debian Security Tracker CVE-2018-0739 vendor-advisory
- www.oracle.com patch third-party-advisory
- www.oracle.com
- www.oracle.com
- 103518 third-party-advisory vdb-entry
- 105609 vdb-entry
- 1040576 third-party-advisory vdb-entry
- RHSA-2018:3090 vendor-advisory
- RHSA-2018:3221 vendor-advisory
- RHSA-2018:3505 vendor-advisory
- RHSA-2019:0366 vendor-advisory
- RHSA-2019:0367 vendor-advisory
- RHSA-2019:1711 vendor-advisory
- RHSA-2019:1712 vendor-advisory
- git.openssl.org
- git.openssl.org
- [debian-lts-announce] 20180330 [SECURITY] [DLA 1330-1] openssl security update mailing-list third-party-advisory
- nodejs.org
- GLSA-201811-21 vendor-advisory
- GLSA-202007-53 vendor-advisory
- security.netapp.com third-party-advisory
- security.netapp.com
- securityadvisories.paloaltonetworks.com
- USN-3611-1 third-party-advisory vendor-advisory
- USN-3611-2 third-party-advisory vendor-advisory
- DSA-4157 third-party-advisory vendor-advisory
- DSA-4158 third-party-advisory vendor-advisory
- www.openssl.org vendor-advisory
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.tenable.com
- www.tenable.com
- www.tenable.com
- security.alpinelinux.org vendor-advisory