Vulnerability Description
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openssl | Openssl | 0.9.7j |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/100515Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039726Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:3221
- https://access.redhat.com/errata/RHSA-2018:3505
- https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
- https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d58
- https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc
- https://security.gentoo.org/glsa/201712-03
- https://security.netapp.com/advisory/ntap-20170927-0001/Issue TrackingThird Party Advisory
- https://security.netapp.com/advisory/ntap-20171107-0002/Issue TrackingThird Party Advisory
FAQ
What is CVE-2017-3735?
CVE-2017-3735 is a vulnerability with a CVSS score of 5.3 (MEDIUM). While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been prese...
How severe is CVE-2017-3735?
CVE-2017-3735 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-3735?
Check the references section above for vendor advisories and patch information. Affected products include: Openssl Openssl, Debian Debian Linux.