vulnwire
5.9med

CVE-2018-0733

Incorrect CRYPTO_memcmp on HP-UX PA-RISC

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
8.3%
percentile 95%
Public exploits
0
none known

Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).

Exploit prediction (EPSS)

8.28% probability of exploitation in the next 30 days, higher than 95% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • OpenSSL OpenSSL

Classification

Technology feeds
OpenSSL (RSS, critical only)

References

  • tenable.com /security/tns-2018-07 · x_refsource_CONFIRM, x_transferred
  • tenable.com /security/tns-2018-04 · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2018-4258247.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpujan2019-5072801.html · x_refsource_CONFIRM, x_transferred
  • security.gentoo.org /glsa/201811-21 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securityfocus.com /bid/103517 · vdb-entry, x_refsource_BID, x_transferred
  • tenable.com /security/tns-2018-06 · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
  • security.netapp.com /advisory/ntap-20180330-0002/ · x_refsource_CONFIRM, x_transferred
  • securitytracker.com /id/1040576 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • git.openssl.org /gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56d5a4bfcaf37fa420aef2bb881aa55e61cf5f2f · x_refsource_CONFIRM, x_transferred
  • openssl.org /news/secadv/20180327.txt · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuapr2019-5072813.html · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2019-5072835.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.