CVE-2017-3731

Published: May 4, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.

Affected (22)

Products: Openssl: Openssl · Nodejs: Node.js

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.1.0a
Openssl Openssl	Version 1.1.0b
Openssl Openssl	Version 1.1.0c

Configuration B

13 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	Version 1.0.2
Openssl Openssl	Version 1.0.2 beta1
Openssl Openssl	Version 1.0.2 beta2
Openssl Openssl	Version 1.0.2 beta3
Openssl Openssl	Version 1.0.2a
Openssl Openssl	Version 1.0.2b
Openssl Openssl	Version 1.0.2c
Openssl Openssl	Version 1.0.2d
Openssl Openssl	Version 1.0.2e
Openssl Openssl	Version 1.0.2f
Openssl Openssl	Version 1.0.2h
Openssl Openssl	Version 1.0.2i
Openssl Openssl	Version 1.0.2j

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 4.0.0 to 4.1.2
Nodejs Node.js	From 5.0.0 to 5.12.0
Nodejs Node.js	From 6.0.0 to 6.8.1
Nodejs Node.js	From 7.0.0 to 7.5.0
Nodejs Node.js	From 4.2.0 to 4.7.3
Nodejs Node.js	From 6.9.0 to 6.9.5

Related CWEs

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (40)

http://rhn.redhat.com/errata/RHSA-2017-0286.html

Source: openssl-security@openssl.org

Third Party Advisory

http://www.debian.org/security/2017/dsa-3773

Source: openssl-security@openssl.org

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: openssl-security@openssl.org

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: openssl-security@openssl.org

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: openssl-security@openssl.org

PatchThird Party Advisory

http://www.securityfocus.com/bid/95813

Source: openssl-security@openssl.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037717

Source: openssl-security@openssl.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:2185

Source: openssl-security@openssl.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2186

Source: openssl-security@openssl.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2187

Source: openssl-security@openssl.org

Third Party Advisory

https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21

Source: openssl-security@openssl.org

Third Party Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc

Source: openssl-security@openssl.org

Third Party Advisory

https://security.gentoo.org/glsa/201702-07

Source: openssl-security@openssl.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20171019-0002/

Source: openssl-security@openssl.org

Third Party Advisory

https://security.paloaltonetworks.com/CVE-2017-3731

Source: openssl-security@openssl.org

Third Party Advisory

https://source.android.com/security/bulletin/pixel/2017-11-01

Source: openssl-security@openssl.org

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us

Source: openssl-security@openssl.org

Third Party Advisory

https://www.openssl.org/news/secadv/20170126.txt

Source: openssl-security@openssl.org

Vendor Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: openssl-security@openssl.org

PatchThird Party Advisory

https://www.tenable.com/security/tns-2017-04

Source: openssl-security@openssl.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2017-0286.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2017/dsa-3773

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

http://www.securityfocus.com/bid/95813

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037717

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:2185

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2186

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2018:2187

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.gentoo.org/glsa/201702-07

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20171019-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.paloaltonetworks.com/CVE-2017-3731

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://source.android.com/security/bulletin/pixel/2017-11-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.openssl.org/news/secadv/20170126.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.tenable.com/security/tns-2017-04

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.