UBUNTU-CVE-2017-3735

See a problem?

Source

https://ubuntu.com/security/notices/UBUNTU-CVE-2017-3735

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-3735.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-3735

Related

Published

2017-08-28T00:00:00Z

Modified

2017-08-28T00:00:00Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.

References

Affected packages

Ubuntu:14.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.23?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.1f-1ubuntu2.23

Affected versions

1.*

1.0.1e-3ubuntu1

1.0.1e-4ubuntu1

1.0.1e-4ubuntu2

1.0.1e-4ubuntu3

1.0.1e-4ubuntu4

1.0.1f-1ubuntu1

1.0.1f-1ubuntu2

1.0.1f-1ubuntu2.1

1.0.1f-1ubuntu2.2

1.0.1f-1ubuntu2.3

1.0.1f-1ubuntu2.4

1.0.1f-1ubuntu2.5

1.0.1f-1ubuntu2.7

1.0.1f-1ubuntu2.8

1.0.1f-1ubuntu2.11

1.0.1f-1ubuntu2.12

1.0.1f-1ubuntu2.15

1.0.1f-1ubuntu2.16

1.0.1f-1ubuntu2.17

1.0.1f-1ubuntu2.18

1.0.1f-1ubuntu2.19

1.0.1f-1ubuntu2.20

1.0.1f-1ubuntu2.21

1.0.1f-1ubuntu2.22

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libssl1.0.0-udeb-dbgsym": "1.0.1f-1ubuntu2.23",
            "libssl-dev": "1.0.1f-1ubuntu2.23",
            "libssl1.0.0": "1.0.1f-1ubuntu2.23",
            "libssl-doc": "1.0.1f-1ubuntu2.23",
            "libcrypto1.0.0-udeb-dbgsym": "1.0.1f-1ubuntu2.23",
            "libssl1.0.0-dbg": "1.0.1f-1ubuntu2.23",
            "libssl-dev-dbgsym": "1.0.1f-1ubuntu2.23",
            "openssl": "1.0.1f-1ubuntu2.23",
            "openssl-dbgsym": "1.0.1f-1ubuntu2.23",
            "libssl1.0.0-udeb": "1.0.1f-1ubuntu2.23",
            "libssl1.0.0-dbgsym": "1.0.1f-1ubuntu2.23",
            "libcrypto1.0.0-udeb": "1.0.1f-1ubuntu2.23"
        }
    ]
}

Ubuntu:16.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl@1.0.2g-1ubuntu4.9?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.2g-1ubuntu4.9

Affected versions

1.*

1.0.2d-0ubuntu1

1.0.2d-0ubuntu2

1.0.2e-1ubuntu1

1.0.2f-2ubuntu1

1.0.2g-1ubuntu2

1.0.2g-1ubuntu3

1.0.2g-1ubuntu4

1.0.2g-1ubuntu4.1

1.0.2g-1ubuntu4.2

1.0.2g-1ubuntu4.4

1.0.2g-1ubuntu4.5

1.0.2g-1ubuntu4.6

1.0.2g-1ubuntu4.8

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libssl1.0.0-udeb-dbgsym": "1.0.2g-1ubuntu4.9",
            "libssl-dev": "1.0.2g-1ubuntu4.9",
            "libssl1.0.0": "1.0.2g-1ubuntu4.9",
            "libssl-doc": "1.0.2g-1ubuntu4.9",
            "libcrypto1.0.0-udeb-dbgsym": "1.0.2g-1ubuntu4.9",
            "libssl1.0.0-dbg": "1.0.2g-1ubuntu4.9",
            "libssl-dev-dbgsym": "1.0.2g-1ubuntu4.9",
            "openssl": "1.0.2g-1ubuntu4.9",
            "openssl-dbgsym": "1.0.2g-1ubuntu4.9",
            "libssl1.0.0-udeb": "1.0.2g-1ubuntu4.9",
            "libssl1.0.0-dbgsym": "1.0.2g-1ubuntu4.9",
            "libcrypto1.0.0-udeb": "1.0.2g-1ubuntu4.9"
        }
    ]
}

Ubuntu:18.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl@1.0.2g-1ubuntu14?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.2g-1ubuntu14

Affected versions

1.*

1.0.2g-1ubuntu13

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libssl-doc": "1.0.2g-1ubuntu14",
            "libssl-dev": "1.0.2g-1ubuntu14",
            "libssl1.0-dev": "1.0.2g-1ubuntu14",
            "libssl1.0.0-dbg": "1.0.2g-1ubuntu14",
            "openssl": "1.0.2g-1ubuntu14",
            "openssl-dbgsym": "1.0.2g-1ubuntu14",
            "libssl1.0.0-udeb": "1.0.2g-1ubuntu14",
            "libssl1.0.0": "1.0.2g-1ubuntu14",
            "libcrypto1.0.0-udeb": "1.0.2g-1ubuntu14"
        }
    ]
}

Ubuntu:18.04:LTS / openssl1.0

Package

Name: openssl1.0
Purl: pkg:deb/ubuntu/openssl1.0@1.0.2n-1ubuntu4?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.2n-1ubuntu4

Affected versions

1.*

1.0.2n-1ubuntu2

1.0.2n-1ubuntu3

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libssl1.0.0-dbgsym": "1.0.2n-1ubuntu4",
            "libssl1.0-dev": "1.0.2n-1ubuntu4",
            "openssl1.0": "1.0.2n-1ubuntu4",
            "openssl1.0-dbgsym": "1.0.2n-1ubuntu4",
            "libssl1.0.0-udeb": "1.0.2n-1ubuntu4",
            "libssl1.0.0": "1.0.2n-1ubuntu4",
            "libcrypto1.0.0-udeb": "1.0.2n-1ubuntu4"
        }
    ]
}