CVE-2017-3735

CVE-2017-3735: falha em OpenSSL

Publicada em · Atualizada em

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 21%
probabilidade de exploração
21%top 2% das CVEs
exploração observada
nãonenhuma fonte reporta
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
Produtos afetados
OpenSSL Software Foundation · OpenSSL
CVEs relacionadas — OpenSSL

No mesmo produto, das mais perigosas para as menos.

CVE-2017-3737—CVE-2017-3737EPSS 78.7%CVE-2017-3738—CVE-2017-3738EPSS 13.4%CVE-2017-3736—CVE-2017-3736EPSS 10.1%
Referências
https://access.redhat.com/errata/RHSA-2018:3221https://access.redhat.com/errata/RHSA-2018:3505https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdfhttps://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822https://lists.debian.org/debian-lts-announce/2017/11/msg00011.htmlhttps://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.aschttps://security.gentoo.org/glsa/201712-03https://security.netapp.com/advisory/ntap-20170927-0001/https://security.netapp.com/advisory/ntap-20171107-0002/https://support.apple.com/HT208331https://usn.ubuntu.com/3611-2/https://www.debian.org/security/2017/dsa-4017