CVE-2018-0733

Published: Mar 27, 2018Modified: Nov 21, 2024

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).

Affected (1)

Products: Openssl: Openssl

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openssl Openssl	From 1.1.0 to 1.1.0g

References (28)

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: openssl-security@openssl.org

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: openssl-security@openssl.org

http://www.securityfocus.com/bid/103517

Source: openssl-security@openssl.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040576

Source: openssl-security@openssl.org

Third Party AdvisoryVDB Entry

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56d5a4bfcaf37fa420aef2bb881aa55e61cf5f2f

Source: openssl-security@openssl.org

https://security.gentoo.org/glsa/201811-21

Source: openssl-security@openssl.org

https://security.netapp.com/advisory/ntap-20180330-0002/

Source: openssl-security@openssl.org

Third Party Advisory

https://www.openssl.org/news/secadv/20180327.txt

Source: openssl-security@openssl.org

Vendor Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: openssl-security@openssl.org

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: openssl-security@openssl.org

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: openssl-security@openssl.org

https://www.tenable.com/security/tns-2018-04

Source: openssl-security@openssl.org

https://www.tenable.com/security/tns-2018-06

Source: openssl-security@openssl.org

https://www.tenable.com/security/tns-2018-07

Source: openssl-security@openssl.org

http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/103517

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040576

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56d5a4bfcaf37fa420aef2bb881aa55e61cf5f2f

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201811-21

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20180330-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.openssl.org/news/secadv/20180327.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.tenable.com/security/tns-2018-04

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.tenable.com/security/tns-2018-06

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.tenable.com/security/tns-2018-07

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.