CVE-2017-3738

There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.
References
Link Resource
https://www.openssl.org/news/secadv/20171207.txt Vendor Advisory
http://www.securitytracker.com/id/1039978 Third Party Advisory VDB Entry
https://security.netapp.com/advisory/ntap-20171208-0001/ Third Party Advisory
http://www.securityfocus.com/bid/102118 Third Party Advisory VDB Entry
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:12.openssl.asc Third Party Advisory
https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/ Vendor Advisory
https://security.gentoo.org/glsa/201712-03 Third Party Advisory
https://www.debian.org/security/2017/dsa-4065 Third Party Advisory
https://www.tenable.com/security/tns-2017-16 Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch Third Party Advisory
https://github.com/openssl/openssl/commit/e502cc86df9dafded1694fceb3228ee34d11c11a Patch Third Party Advisory
https://www.openssl.org/news/secadv/20180327.txt Vendor Advisory
https://www.debian.org/security/2018/dsa-4157 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:0998 Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html Patch Third Party Advisory
https://www.tenable.com/security/tns-2018-04 Third Party Advisory
https://www.tenable.com/security/tns-2018-07 Third Party Advisory
https://www.tenable.com/security/tns-2018-06 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2187 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2186 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:2185 Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html Patch Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03881en_us Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html Patch Third Party Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:openssl:openssl:1.1.0e:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.1.0f:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.1.0d:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.1.0g:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*

Information

Published : 2017-12-07 08:29

Updated : 2022-08-19 04:49


NVD link : CVE-2017-3738

Mitre link : CVE-2017-3738


JSON object : View

CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

dedicated server usa

Products Affected

debian

  • debian_linux

nodejs

  • node.js

openssl

  • openssl