Уязвимость CVE-2018-0732: Информация

Описание

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Важность: HIGH (7,5) Вектор: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2018-0732

Опубликовано: 12 июня 2018 г.

Изменено: 7 ноября 2023 г.

Идентификатор типа ошибки: CWE-320

Исправленные пакеты

Имя пакета	Ветка	Исправлено в версии	Версия в репозитории	Errata ID	№ Задания	Состояние
node	sisyphus	8.11.4-alt1	20.13.1-alt1	ALT-PU-2018-2246-1	212067	Исправлено
node	p10	8.11.4-alt1	16.19.1-alt1	ALT-PU-2018-2246-1	212067	Исправлено
node	p9	8.11.4-alt1	14.17.2-alt1	ALT-PU-2018-2246-1	212067	Исправлено
node	p8	8.11.4-alt0.M80P.1	8.11.4-alt0.M80P.1	ALT-PU-2018-2477-1	213669	Исправлено
node	c10f1	8.11.4-alt1	16.19.1-alt1	ALT-PU-2018-2246-1	212067	Исправлено
node	c9f2	8.11.4-alt1	16.19.1-alt0.c9.1	ALT-PU-2018-2246-1	212067	Исправлено
node	p11	8.11.4-alt1	20.13.1-alt1	ALT-PU-2018-2246-1	212067	Исправлено
openssl10	p9	1.0.2p-alt1	1.0.2u-alt1.p9.2	ALT-PU-2018-2232-1	211555	Исправлено
openssl10	c9f2	1.0.2p-alt1	1.0.2u-alt1.p9.1	ALT-PU-2018-2232-1	211555	Исправлено

Ссылки на рекомендации, решения и инструменты

Ссылка	Ресурс
https://www.openssl.org/news/secadv/20180612.txt	Vendor Advisory
1041090	Third Party Advisory VDB Entry
104442	Third Party Advisory VDB Entry
USN-3692-2	Third Party Advisory
USN-3692-1	Third Party Advisory
[debian-lts-announce] 20180728 [SECURITY] [DLA 1449-1] openssl security update	Third Party Advisory
RHSA-2018:2553	Third Party Advisory
RHSA-2018:2552	Third Party Advisory
https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/	Vendor Advisory
https://www.tenable.com/security/tns-2018-12	Third Party Advisory
https://securityadvisories.paloaltonetworks.com/Home/Detail/133	Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html	Patch Third Party Advisory
https://www.tenable.com/security/tns-2018-14	Third Party Advisory
https://www.tenable.com/security/tns-2018-13	Third Party Advisory
RHSA-2018:3221	Third Party Advisory
https://security.netapp.com/advisory/ntap-20181105-0001/	Third Party Advisory
RHSA-2018:3505	Third Party Advisory
GLSA-201811-03	Third Party Advisory
DSA-4348	Third Party Advisory
DSA-4355	Third Party Advisory
https://www.tenable.com/security/tns-2018-17	Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20190118-0002/	Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Third Party Advisory
RHSA-2019:1297	Third Party Advisory
RHSA-2019:1296	Third Party Advisory
RHSA-2019:1543	Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	Patch Third Party Advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	Patch Third Party Advisory
N/A	Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html	Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf	Third Party Advisory
FEDORA-2019-db06efdea1
FEDORA-2019-00c25b9379
FEDORA-2019-9a0a7c0986
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4

Подверженные конфигурации:
1. Конфигурация 1
  cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
  Start including
  1.1.0
  End including
  1.1.0h
  cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
  Start including
  1.0.2
  End including
  1.0.2o
  
  Конфигурация 2
  cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
  
  Конфигурация 3
  cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
  Start including
  8.9.0
  End excliding
  8.11.4
  cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
  Start including
  8.0.0
  End excliding
  8.8.1
  cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
  Start including
  10.0.0
  End excliding
  10.9.0
  cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
  Start including
  6.9.0
  End excliding
  6.14.4
  cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
  Start including
  6.0.0
  End excliding
  6.8.1

Версия: v24.5.3

Наверх

Уязвимость CVE-2018-0732: Информация

Описание

Исправленные пакеты

Ссылки на рекомендации, решения и инструменты

Конфигурация 1

Конфигурация 2

Конфигурация 3