PT-2018-2793 · Openssl · Openssl

Publicado 2018-03-02 · Atualizado 2020-08-24 · CVE-2018-0733

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.0 through 1.1.0g

Description The issue is related to an implementation bug in the PA-RISC CRYPTO memcmp function, which effectively reduces the comparison to only the least significant bit of each byte. This allows an attacker to forge messages that would be considered authenticated in a lower number of attempts than guaranteed by the security claims. The vulnerability is specific to HP-UX PA-RISC targets due to compilation requirements.

Recommendations For versions 1.1.0 through 1.1.0g, update to OpenSSL 1.1.0h to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-01882

CVE-2018-0733

Produtos afetados

Openssl

Referências · 22

• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Nota
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Nota
• https://security.netapp.com/advisory/ntap-20180330-0002 · Nota
• https://security.gentoo.org/glsa/201811-21 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01882 · Nota de Segurança
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Nota
• https://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Nota
• https://tenable.com/security/tns-2018-06 · Nota
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56d5a4bfcaf37fa420aef2bb881aa55e61cf5f2f · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-0733 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-0733 · Aviso do Fabricante
• https://opennet.ru/opennews/art.shtml?num=48343 · Nota
• http://securityfocus.com/bid/103517 · Nota
• https://openssl.org/news/secadv/20180327.txt · Aviso do Fabricante
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Nota