CVE-2018-0737

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

Database specific

{
    "unresolved_ranges": [
        {
            "cpe": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "14.04"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "cpe": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "16.04"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "cpe": "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*",
            "extracted_events": [
                {
                    "last_affected": "17.10"
                }
            ],
            "source": "CPE_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type

GIT

Repo

https://github.com/openssl/openssl

Events

Introduced

e818b74be2170fbe957a07b0da4401c2b694b3b8

Last affected

e818b74be2170fbe957a07b0da4401c2b694b3b8

Introduced

7ea5bd2b52d0e81eaef3d109b3b12545306f201c

Last affected

7ea5bd2b52d0e81eaef3d109b3b12545306f201c

Database specific

{
    "cpe": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.2b"
        },
        {
            "last_affected": "1.0.2o"
        },
        {
            "introduced": "1.1.0"
        },
        {
            "last_affected": "1.1.0h"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

Other

OpenSSL_1_0_2u

OpenSSL_1_1_0l

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-0737.json"