CVE-2017-3730

Published: May 4, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.

Affected (18)

Products: Openssl: Openssl · Oracle: Agile Engineering Data Management, Communications Application Session Controller, Communications Eagle Lnp Application Processor, Communications Operations Monitor, Jd Edwards Enterpriseone Tools, Jd Edwards World Security

1 product

6 products

Agile Engineering Data Management

Communications Application Session Controller

Communications Eagle Lnp Application Processor

Communications Operations Monitor

Jd Edwards Enterpriseone Tools

Jd Edwards World Security

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.1.0
Openssl Openssl	Version 1.1.0a
Openssl Openssl	Version 1.1.0b
Openssl Openssl	Version 1.1.0c

Configuration B

14 vulnerable

Vulnerable Software	Affected Versions
Oracle Agile Engineering Data Management	Version 6.1.3
Oracle Agile Engineering Data Management	Version 6.2.0
Oracle Communications Application Session Controller	Version 3.7.1
Oracle Communications Application Session Controller	Version 3.8.0
Oracle Communications Eagle Lnp Application Processor	Version 10.0
Oracle Communications Eagle Lnp Application Processor	Version 10.1
Oracle Communications Eagle Lnp Application Processor	Version 10.2
Oracle Communications Operations Monitor	Version 3.4
Oracle Communications Operations Monitor	Version 4.0
Oracle Jd Edwards Enterpriseone Tools	Version 9.2
Oracle Jd Edwards World Security	Version a9.1
Oracle Jd Edwards World Security	Version a9.2
Oracle Jd Edwards World Security	Version a9.3
Oracle Jd Edwards World Security	Version a9.4

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (20)

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: openssl-security@openssl.org

Patch

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: openssl-security@openssl.org

Patch

http://www.securityfocus.com/bid/95812

Source: openssl-security@openssl.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037717

Source: openssl-security@openssl.org

Third Party AdvisoryVDB Entry

https://github.com/openssl/openssl/commit/efbe126e3ebb9123ac9d058aa2bb044261342aaa

Source: openssl-security@openssl.org

PatchThird Party Advisory

https://security.gentoo.org/glsa/201702-07

Source: openssl-security@openssl.org

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us

Source: openssl-security@openssl.org

Third Party Advisory

https://www.exploit-db.com/exploits/41192/

Source: openssl-security@openssl.org

ExploitThird Party AdvisoryVDB Entry

https://www.openssl.org/news/secadv/20170126.txt

Source: openssl-security@openssl.org

PatchVendor Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: openssl-security@openssl.org

Patch

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://www.securityfocus.com/bid/95812

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037717

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://github.com/openssl/openssl/commit/efbe126e3ebb9123ac9d058aa2bb044261342aaa

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://security.gentoo.org/glsa/201702-07

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.exploit-db.com/exploits/41192/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.openssl.org/news/secadv/20170126.txt

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

Timeline

No history available yet.