PT-2017-3947 · Openssl+7 · Openssl+7

Published 2017-08-28 · Updated 2024-06-15 · CVE-2017-3735

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 1.0.2m OpenSSL versions prior to 1.1.0g

Description The issue is related to parsing an IPAddressFamily extension in an X.509 certificate, which can lead to a one-byte overread. This results in an incorrect text display of the certificate. The bug has been present since 2006.

Recommendations For versions prior to 1.0.2m, update to version 1.0.2m or later. For versions prior to 1.1.0g, update to version 1.1.0g or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2017-2586

BDU:2020-02912

CESA-2018_3221

CVE-2017-3735

DLA-1157-1

DSA-4017-1

DSA-4018-1

FREEBSD-SA-17_11

MGASA-2017-0405

OESA-2022-1938

OPENSUSE-SU-2024:11126-1

OPENSUSE-SU-2024:11127-1

RHSA-2018:3221

RHSA-2018_3221

SUSE-FU-2022:0445-1

SUSE-SU-2017:2968-1

SUSE-SU-2017:2981-1

SUSE-SU-2017:3169-1

SUSE-SU-2017_2968-1

SUSE-SU-2017_2981-1

SUSE-SU-2017_3169-1

SUSE-SU-2018:0002-1

SUSE-SU-2018:0112-1

SUSE-SU-2018:0293-1

SUSE-SU-2019:14246-1

SUSE-SU-2019_14246-1

USN-3475-1

USN-3611-2

Affected Products

Alt Linux

Centos

Freebsd

Ibm Aix

Openssl

Red Hat

Suse

Ubuntu

References · 452

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2016-5172.md · Exploit
• 🔥 https://github.com/ssllabs/openssl-ccs-cve-2014-0224 · Exploit
• 🔥 https://github.com/secretnonempty/CVE-2014-0224 · Exploit
• 🔥❌ https://github.com/alidnf/CVE-2019-11730 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2017-3735 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3475-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0405.html · Security Note
• https://openssl.org/news/secadv/20171102.txt · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3735 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3611-2 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4018-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3505 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:14246-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3475-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0112-1 · Vendor Advisory