CVE-2017-3738
- Source
- https://cve.org/CVERecord?id=CVE-2017-3738
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-3738.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2017-3738
- Downstream
ALPINE (1)
DEBIAN (1)
MGASA (1)
openSUSE (2)
SUSE (5)
UBUNTU (1)
- Related
- Published
- 2017-12-07T16:29:00Z
- Modified
- 2026-11-11T10:45:17Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- [none]
- Details
-
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH1024 are considered just feasible, because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version 1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.
- Database specific
{ "unresolved_ranges": [ { "cpes": [ "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "8.0" }, { "last_affected": "8.0" }, { "introduced": "9.0" }, { "last_affected": "9.0" } ], "source": "CPE_STRING" } ], "vendor_product": "debian:debian_linux" }, { "cpes": [ "cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.1.0d:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.1.0e:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.1.0f:*:*:*:*:*:*:*", "cpe:2.3:a:openssl:openssl:1.1.0g:*:*:*:*:*:*:*" ], "extracted_events": [ { "range": [ { "introduced": "1.0.2" }, { "last_affected": "1.0.2" }, { "introduced": "1.0.2-beta1" }, { "last_affected": "1.0.2-beta1" }, { "introduced": "1.0.2-beta1" }, { "last_affected": "1.0.2-beta1" }, { "introduced": "1.0.2-beta2" }, { "last_affected": "1.0.2-beta2" }, { "introduced": "1.0.2-beta2" }, { "last_affected": "1.0.2-beta2" }, { "introduced": "1.0.2-beta3" }, { "last_affected": "1.0.2-beta3" }, { "introduced": "1.0.2-beta3" }, { "last_affected": "1.0.2-beta3" }, { "introduced": "1.0.2a" }, { "last_affected": "1.0.2a" }, { "introduced": "1.0.2b" }, { "last_affected": "1.0.2b" }, { "introduced": "1.0.2c" }, { "last_affected": "1.0.2c" }, { "introduced": "1.0.2d" }, { "last_affected": "1.0.2d" }, { "introduced": "1.0.2e" }, { "last_affected": "1.0.2e" }, { "introduced": "1.0.2f" }, { "last_affected": "1.0.2f" }, { "introduced": "1.0.2g" }, { "last_affected": "1.0.2g" }, { "introduced": "1.0.2h" }, { "last_affected": "1.0.2h" }, { "introduced": "1.0.2i" }, { "last_affected": "1.0.2i" }, { "introduced": "1.0.2j" }, { "last_affected": "1.0.2j" }, { "introduced": "1.0.2k" }, { "last_affected": "1.0.2k" }, { "introduced": "1.0.2l" }, { "last_affected": "1.0.2l" }, { "introduced": "1.0.2m" }, { "last_affected": "1.0.2m" }, { "introduced": "1.1.0" }, { "last_affected": "1.1.0" }, { "introduced": "1.1.0" }, { "last_affected": "1.1.0" }, { "introduced": "1.1.0a" }, { "last_affected": "1.1.0a" }, { "introduced": "1.1.0a" }, { "last_affected": "1.1.0a" }, { "introduced": "1.1.0b" }, { "last_affected": "1.1.0b" }, { "introduced": "1.1.0b" }, { "last_affected": "1.1.0b" }, { "introduced": "1.1.0c" }, { "last_affected": "1.1.0c" }, { "introduced": "1.1.0c" }, { "last_affected": "1.1.0c" }, { "introduced": "1.1.0d" }, { "last_affected": "1.1.0d" }, { "introduced": "1.1.0d" }, { "last_affected": "1.1.0d" }, { "introduced": "1.1.0e" }, { "last_affected": "1.1.0e" }, { "introduced": "1.1.0e" }, { "last_affected": "1.1.0e" }, { "introduced": "1.1.0f" }, { "last_affected": "1.1.0f" }, { "introduced": "1.1.0f" }, { "last_affected": "1.1.0f" }, { "introduced": "1.1.0g" }, { "last_affected": "1.1.0g" }, { "introduced": "1.1.0g" }, { "last_affected": "1.1.0g" } ], "source": "CPE_STRING" } ], "vendor_product": "openssl:openssl" } ] }- References
-
- http://www.securityfocus.com/bid/102118
- http://www.securitytracker.com/id/1039978
- https://access.redhat.com/errata/RHSA-2018:0998
- https://access.redhat.com/errata/RHSA-2018:2185
- https://access.redhat.com/errata/RHSA-2018:2186
- https://access.redhat.com/errata/RHSA-2018:2187
- https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:12.openssl.asc
- https://security.gentoo.org/glsa/201712-03
- https://security.netapp.com/advisory/ntap-20171208-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03881en_us
- https://www.debian.org/security/2017/dsa-4065
- https://www.debian.org/security/2018/dsa-4157
- https://www.openssl.org/news/secadv/20171207.txt
- https://www.openssl.org/news/secadv/20180327.txt
- https://www.tenable.com/security/tns-2017-16
- https://www.tenable.com/security/tns-2018-04
- https://www.tenable.com/security/tns-2018-06
- https://www.tenable.com/security/tns-2018-07
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://github.com/openssl/openssl/commit/e502cc86df9dafded1694fceb3228ee34d11c11a
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Affected packages
Git
github.com/alsyundawy/openssl-1.0.2
Affected ranges
- Type
- GIT
- Repo
- https://github.com/alsyundawy/openssl-1.0.2
- Events
-
IntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2" }, { "last_affected": "1.0.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2a" }, { "last_affected": "1.0.2a" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2b" }, { "last_affected": "1.0.2b" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2c" }, { "last_affected": "1.0.2c" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2d" }, { "last_affected": "1.0.2d" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2e" }, { "last_affected": "1.0.2e" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2f" }, { "last_affected": "1.0.2f" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2g" }, { "last_affected": "1.0.2g" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2h" }, { "last_affected": "1.0.2h" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2i" }, { "last_affected": "1.0.2i" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2j" }, { "last_affected": "1.0.2j" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2k" }, { "last_affected": "1.0.2k" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2l" }, { "last_affected": "1.0.2l" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2m" }, { "last_affected": "1.0.2m" } ], "source": "CPE_STRING" } ] }
github.com/nodejs/node
Affected ranges
- Type
- GIT
- Repo
- https://github.com/nodejs/node
- Events
-
IntroducedLast AffectedIntroducedFixedIntroducedLast AffectedIntroducedFixedIntroducedLast AffectedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "range": [ { "introduced": "4.0.0" }, { "last_affected": "4.1.2" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "range": [ { "introduced": "4.2.0" }, { "fixed": "4.8.7" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "range": [ { "introduced": "6.0.0" }, { "last_affected": "6.8.1" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "range": [ { "introduced": "6.9.0" }, { "fixed": "6.12.2" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "range": [ { "introduced": "8.0.0" }, { "last_affected": "8.8.1" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "range": [ { "introduced": "8.9.0" }, { "fixed": "8.9.3" } ], "source": "CPE_RANGE" }, { "cpe": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "range": [ { "introduced": "9.0.0" }, { "fixed": "9.2.1" } ], "source": "CPE_RANGE" } ] }
Affected versions
v4.*
v4.0.0
v4.1.0
v4.1.1
v4.1.2
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.2.6
v4.3.0
v4.3.1
v4.3.2
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.4.4
v4.4.5
v4.4.6
v4.4.7
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.7.0
v4.7.1
v4.7.2
v4.7.3
v4.8.0
v4.8.1
v4.8.2
v4.8.3
v4.8.4
v4.8.5
v4.8.6
v6.*
v6.0.0
v6.1.0
v6.10.0
v6.10.1
v6.10.2
v6.10.3
v6.11.0
v6.11.1
v6.11.2
v6.11.3
v6.11.4
v6.11.5
v6.12.0
v6.12.1
v6.2.0
v6.2.1
v6.2.2
v6.3.0
v6.3.1
v6.4.0
v6.5.0
v6.6.0
v6.7.0
v6.8.0
v6.8.1
v6.9.0
v6.9.1
v6.9.2
v6.9.3
v6.9.4
v6.9.5
v8.*
v8.0.0
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.1.4
v8.2.0
v8.2.1
v8.3.0
v8.4.0
v8.5.0
v8.6.0
v8.7.0
v8.8.0
v8.8.1
v8.9.0
v8.9.1
v8.9.2
v9.*
v9.0.0
v9.1.0
v9.2.0
github.com/openssl/openssl
Affected ranges
- Type
- GIT
- Repo
- https://github.com/openssl/openssl
- Events
-
IntroducedLast AffectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2" }, { "last_affected": "1.0.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2a" }, { "last_affected": "1.0.2a" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2b" }, { "last_affected": "1.0.2b" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2c" }, { "last_affected": "1.0.2c" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2d" }, { "last_affected": "1.0.2d" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2e" }, { "last_affected": "1.0.2e" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2f" }, { "last_affected": "1.0.2f" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2g" }, { "last_affected": "1.0.2g" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2h" }, { "last_affected": "1.0.2h" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2i" }, { "last_affected": "1.0.2i" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2j" }, { "last_affected": "1.0.2j" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2k" }, { "last_affected": "1.0.2k" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2l" }, { "last_affected": "1.0.2l" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2m:*:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2m" }, { "last_affected": "1.0.2m" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2-beta1" }, { "last_affected": "1.0.2-beta1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2-beta2" }, { "last_affected": "1.0.2-beta2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*", "range": [ { "introduced": "1.0.2-beta3" }, { "last_affected": "1.0.2-beta3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.0" }, { "last_affected": "1.1.0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.0a" }, { "last_affected": "1.1.0a" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.0b" }, { "last_affected": "1.1.0b" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.0c" }, { "last_affected": "1.1.0c" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.0d:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.0d" }, { "last_affected": "1.1.0d" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.0e:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.0e" }, { "last_affected": "1.1.0e" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.0f:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.0f" }, { "last_affected": "1.1.0f" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:openssl:openssl:1.1.0g:*:*:*:*:*:*:*", "range": [ { "introduced": "1.1.0g" }, { "last_affected": "1.1.0g" } ], "source": "CPE_STRING" }, { "range": [ { "fixed": "e502cc86df9dafded1694fceb3228ee34d11c11a" } ], "source": "REFERENCES_COMMIT" } ] }