CVE-2017-3735

CVE-2017-3735: vulnerability in OpenSSL

Published · Updated

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 21%
exploitation probability
21%top 2% of all CVEs
observed exploitation
nono source reports it
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
Affected products
OpenSSL Software Foundation · OpenSSL
Related CVEs — OpenSSL

In the same product, most dangerous first.

CVE-2017-3737—CVE-2017-3737EPSS 78.7%CVE-2017-3738—CVE-2017-3738EPSS 13.4%CVE-2017-3736—CVE-2017-3736EPSS 10.1%
References
https://access.redhat.com/errata/RHSA-2018:3221https://access.redhat.com/errata/RHSA-2018:3505https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822https://lists.debian.org/debian-lts-announce/2017/11/msg00011.htmlhttps://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.aschttps://security.gentoo.org/glsa/201712-03https://security.netapp.com/advisory/ntap-20170927-0001/https://security.netapp.com/advisory/ntap-20171107-0002/https://support.apple.com/HT208331https://usn.ubuntu.com/3611-2/https://www.debian.org/security/2017/dsa-4017