CVE-2018-0737

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

References

Affected packages

Git / github.com/openssl/openssl

Affected ranges

Type

GIT

Repo

https://github.com/openssl/openssl

Events

Introduced

e818b74be2170fbe957a07b0da4401c2b694b3b8

Last affected

e818b74be2170fbe957a07b0da4401c2b694b3b8

Introduced

7ea5bd2b52d0e81eaef3d109b3b12545306f201c

Last affected

7ea5bd2b52d0e81eaef3d109b3b12545306f201c

Database specific

{
    "versions": [
        {
            "introduced": "1.0.2b"
        },
        {
            "last_affected": "1.0.2o"
        },
        {
            "introduced": "1.1.0"
        },
        {
            "last_affected": "1.1.0h"
        }
    ]
}

Affected versions

Other

OpenSSL_1_0_2u

OpenSSL_1_1_0l

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "14.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "17.10"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-0737.json"