vulnwire
6.5med

CVE-2018-0739

Constructed ASN.1 types with a recursive definition could exceed the stack

Published 8 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
18.6%
percentile 97%
Public exploits
0
none known

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

Exploit prediction (EPSS)

18.60% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

  • OpenSSL OpenSSL

Classification

Weakness
Technology feeds
OpenSSL (RSS, critical only)

References

  • usn.ubuntu.com /3611-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • debian.org /security/2018/dsa-4158 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • security.gentoo.org /glsa/201811-21 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • access.redhat.com /errata/RHSA-2019:0367 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • debian.org /security/2018/dsa-4157 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • access.redhat.com /errata/RHSA-2018:3505 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/103518 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1040576 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • access.redhat.com /errata/RHSA-2018:3221 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/105609 · vdb-entry, x_refsource_BID, x_transferred
  • usn.ubuntu.com /3611-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • lists.debian.org /debian-lts-announce/2018/03/msg00033.html · mailing-list, x_refsource_MLIST, x_transferred
  • access.redhat.com /errata/RHSA-2019:0366 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2018:3090 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:1711 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:1712 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2018-4258247.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuapr2018-3678067.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuoct2018-4428296.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpujan2019-5072801.html · x_refsource_CONFIRM, x_transferred
  • oracle.com /technetwork/security-advisory/cpuapr2019-5072813.html · x_refsource_MISC, x_transferred
  • oracle.com /technetwork/security-advisory/cpujul2019-5072835.html · x_refsource_MISC, x_transferred
  • security.netapp.com /advisory/ntap-20180726-0002/ · x_refsource_CONFIRM, x_transferred
  • security.gentoo.org /glsa/202007-53 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securityadvisories.paloaltonetworks.com /Home/Detail/133 · x_refsource_CONFIRM, x_transferred
  • oracle.com //security-alerts/cpujul2021.html · x_refsource_MISC, x_transferred
  • tenable.com /security/tns-2018-07 · x_refsource_CONFIRM, x_transferred
  • tenable.com /security/tns-2018-04 · x_refsource_CONFIRM, x_transferred
  • nodejs.org /en/blog/vulnerability/march-2018-security-releases/ · x_refsource_CONFIRM, x_transferred
  • git.openssl.org /gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33 · x_refsource_CONFIRM, x_transferred
  • git.openssl.org /gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d · x_refsource_CONFIRM, x_transferred
  • tenable.com /security/tns-2018-06 · x_refsource_CONFIRM, x_transferred
  • security.netapp.com /advisory/ntap-20180330-0002/ · x_refsource_CONFIRM, x_transferred
  • openssl.org /news/secadv/20180327.txt · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.