PT-2018-2793 · Openssl · Openssl

Published 2018-03-02 · Updated 2020-08-24 · CVE-2018-0733

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.1.0 through 1.1.0g

Description The issue is related to an implementation bug in the PA-RISC CRYPTO memcmp function, which effectively reduces the comparison to only the least significant bit of each byte. This allows an attacker to forge messages that would be considered authenticated in a lower number of attempts than guaranteed by the security claims. The vulnerability is specific to HP-UX PA-RISC targets due to compilation requirements.

Recommendations For versions 1.1.0 through 1.1.0g, update to OpenSSL 1.1.0h to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-01882

CVE-2018-0733

Affected Products

Openssl

References · 22

• https://security.gentoo.org/glsa/201811-21 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01882 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-0733 · Security Note
• https://osv.dev/vulnerability/CVE-2018-0733 · Vendor Advisory
• https://openssl.org/news/secadv/20180327.txt · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-0733 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-0733 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-0733 · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html · Note
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Note
• https://security.netapp.com/advisory/ntap-20180330-0002 · Note
• http://oracle.com/technetwork/security-advisory/cpujul2018-4258247.html · Note
• https://oracle.com/technetwork/security-advisory/cpujul2019-5072835.html · Note
• https://tenable.com/security/tns-2018-06 · Note
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56d5a4bfcaf37fa420aef2bb881aa55e61cf5f2f · Note