CVE-2018-0732

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "12.04"
                },
                {
                    "last_affected": "14.04"
                },
                {
                    "last_affected": "16.04"
                },
                {
                    "last_affected": "17.10"
                },
                {
                    "last_affected": "18.04"
                }
            ],
            "cpes": [
                "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
                "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
            ],
            "vendor_product": "canonical:ubuntu_linux",
            "source": "CPE_STRING"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.0"
                }
            ],
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "debian:debian_linux",
            "source": "CPE_STRING"
        }
    ]
}

References

Affected packages

Git / github.com/nodejs/node

Affected ranges

Type

GIT

Repo

https://github.com/nodejs/node

Events

Introduced

ce3e3c5fe15479475c068482c48eb9cbf1ac9df5

Fixed

c6a397bce63fc026421e1515b98eec9b8b5a8468

Introduced

6b1c40be84fbe5ea404f25e4e340a0c1fe67a60a

Fixed

1cb5aed5f596a9cb5b68e3a676222c0c35501a5e

Introduced

0d8021e5a4cf0a6aa3a700a361f6d42c2894f2ba

Fixed

dc6bbb44daec5584a0fbd37f0916baeff3202dba

Introduced

f76ce0a75641991bfc235775a4747c978e0e281b

Fixed

0cae3c3fe5e3f4c275701446a4baf1f2727344f6

Introduced

cf41627411886000429bde058a6594fb7f6d6d47

Fixed

03b825811ed4af0addcdf6e75bacb3dc1c4c5940

Database specific

{
    "extracted_events": [
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.8.1"
        },
        {
            "introduced": "6.9.0"
        },
        {
            "fixed": "6.14.4"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.8.1"
        },
        {
            "introduced": "8.9.0"
        },
        {
            "fixed": "8.11.4"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.9.0"
        }
    ],
    "cpe": [
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*"
    ],
    "source": "CPE_RANGE"
}

Affected versions

v10.*

v10.0.0

v10.1.0

v10.2.0

v10.2.1

v10.3.0

v10.4.0

v10.4.1

v10.5.0

v10.6.0

v10.7.0

v10.8.0

v6.*

v6.0.0

v6.1.0

v6.10.0

v6.10.1

v6.10.2

v6.10.3

v6.11.0

v6.11.1

v6.11.2

v6.11.3

v6.11.4

v6.11.5

v6.12.0

v6.12.1

v6.12.2

v6.12.3

v6.13.0

v6.13.1

v6.14.0

v6.14.1

v6.14.2

v6.14.3

v6.2.0

v6.2.1

v6.2.2

v6.3.0

v6.3.1

v6.4.0

v6.5.0

v6.6.0

v6.7.0

v6.8.0

v6.9.0

v6.9.1

v6.9.2

v6.9.3

v6.9.4

v6.9.5

v8.*

v8.0.0

v8.1.0

v8.1.1

v8.1.2

v8.1.3

v8.1.4

v8.10.0

v8.11.0

v8.11.1

v8.11.2

v8.11.3

v8.2.0

v8.2.1

v8.3.0

v8.4.0

v8.5.0

v8.6.0

v8.7.0

v8.8.0

v8.9.0

v8.9.1

v8.9.2

v8.9.3

v8.9.4

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-0732.json"

Git / github.com/openssl/openssl

Affected ranges

Type

GIT

Repo

https://github.com/openssl/openssl

Events

Introduced

e818b74be2170fbe957a07b0da4401c2b694b3b8

Last affected

e818b74be2170fbe957a07b0da4401c2b694b3b8

Introduced

7ea5bd2b52d0e81eaef3d109b3b12545306f201c

Last affected

7ea5bd2b52d0e81eaef3d109b3b12545306f201c

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.0.2"
        },
        {
            "last_affected": "1.0.2o"
        },
        {
            "introduced": "1.1.0"
        },
        {
            "last_affected": "1.1.0h"
        }
    ],
    "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

Other

OpenSSL_1_0_2u

OpenSSL_1_1_0l

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-0732.json"