CVE-2017-3737medium
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected.
References
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.securityfocus.com/bid/102103
http://www.securitytracker.com/id/1039978
https://access.redhat.com/errata/RHSA-2018:0998
https://access.redhat.com/errata/RHSA-2018:2185
https://access.redhat.com/errata/RHSA-2018:2186
https://access.redhat.com/errata/RHSA-2018:2187
https://cert-portal.siemens.com/productcert/pdf/ssa-179516.pdf
https://github.com/openssl/openssl/commit/898fb884b706aaeb283de4812340bb0bde8476dc
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:12.openssl.asc
https://security.gentoo.org/glsa/201712-03
https://security.netapp.com/advisory/ntap-20171208-0001/
https://security.netapp.com/advisory/ntap-20180117-0002/
https://security.netapp.com/advisory/ntap-20180419-0002/
https://www.debian.org/security/2017/dsa-4065
https://www.digitalmunition.me/2017/12/cve-2017-3737-openssl-security-bypass-vulnerability/
https://www.openssl.org/news/secadv/20171207.txt
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Details
Source: MITRE
Published: 2017-12-07
Updated: 2019-10-03
Type: CWE-125
Risk Information
CVSS v2
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3
Base Score: 5.9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Impact Score: 3.6
Exploitability Score: 2.2
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*
Configuration 2
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 155531 | EulerOS Virtualization 2.9.1 : shim (EulerOS-SA-2021-2758) | Nessus | Huawei Local Security Checks | high |
| 155496 | EulerOS Virtualization 2.9.0 : shim (EulerOS-SA-2021-2785) | Nessus | Huawei Local Security Checks | high |
| 153738 | EulerOS 2.0 SP9 : shim (EulerOS-SA-2021-2542) | Nessus | Huawei Local Security Checks | medium |
| 153705 | EulerOS 2.0 SP9 : shim (EulerOS-SA-2021-2566) | Nessus | Huawei Local Security Checks | medium |
| 127201 | NewStart CGSL CORE 5.04 / MAIN 5.04 : openssl Multiple Vulnerabilities (NS-SA-2019-0033) | Nessus | NewStart CGSL Local Security Checks | critical |
| 124999 | EulerOS Virtualization 3.0.1.0 : openssl (EulerOS-SA-2019-1546) | Nessus | Huawei Local Security Checks | high |
| 700625 | MySQL 5.7.x < 5.7.21 Multiple Vulnerabilities (January 2018 CPU) | Nessus Network Monitor | Database | high |
| 700620 | MySQL 5.6.x < 5.6.39 Multiple Vulnerabilities (January 2018 CPU) | Nessus Network Monitor | Database | high |
| 700523 | OpenSSL 1.0.x < 1.0.2n DoS | Nessus Network Monitor | Web Servers | low |
| 121905 | Photon OS 2.0: Openssl PHSA-2018-2.0-0010-(a) | Nessus | PhotonOS Local Security Checks | medium |
| 121796 | Photon OS 1.0: Openssl PHSA-2018-1.0-0097-(a) | Nessus | PhotonOS Local Security Checks | medium |
| 120014 | SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2018:0293-1) | Nessus | SuSE Local Security Checks | critical |
| 120012 | SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2018:0002-1) | Nessus | SuSE Local Security Checks | critical |
| 111908 | Photon OS 1.0: Openssl PHSA-2018-1.0-0097-(a) (deprecated) | Nessus | PhotonOS Local Security Checks | medium |
| 111600 | MySQL Enterprise Monitor 3.3.x < 3.3.9.3339 / 3.4.x < 3.4.7.4296 / 4.0.x < 4.0.4.5233 Multiple Vulnerabilities (April 2018 CPU) | Nessus | CGI abuses | high |
| 111279 | Photon OS 2.0 : openssl (PhotonOS-PHSA-2018-2.0-0010-(a)) (deprecated) | Nessus | PhotonOS Local Security Checks | medium |
| 111147 | RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 (RHSA-2018:2186) | Nessus | Red Hat Local Security Checks | critical |
| 111146 | RHEL 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 (RHSA-2018:2185) | Nessus | Red Hat Local Security Checks | critical |
| 110843 | EulerOS 2.0 SP3 : openssl (EulerOS-SA-2018-1179) | Nessus | Huawei Local Security Checks | medium |
| 109698 | Amazon Linux AMI : openssl (ALAS-2018-1016) | Nessus | Amazon Linux Local Security Checks | medium |
| 109513 | EulerOS 2.0 SP2 : openssl (EulerOS-SA-2018-1115) | Nessus | Huawei Local Security Checks | medium |
| 109455 | Scientific Linux Security Update : openssl on SL7.x x86_64 (20180410) | Nessus | Scientific Linux Local Security Checks | medium |
| 109406 | Juniper NSM < 2012.2R14 OpenSSL Multiple Vulnerabilities (JSA10851) | Nessus | Misc. | medium |
| 109379 | CentOS 7 : openssl (CESA-2018:0998) | Nessus | CentOS Local Security Checks | medium |
| 109364 | Amazon Linux 2 : openssl (ALAS-2018-1004) | Nessus | Amazon Linux Local Security Checks | medium |
| 109294 | openSUSE Security Update : virtualbox (openSUSE-2018-389) (Optionsbleed) | Nessus | SuSE Local Security Checks | high |
| 109165 | Oracle Secure Global Desktop Multiple Vulnerabilities (April 2018 CPU) | Nessus | Misc. | high |
| 109112 | Oracle Linux 7 : openssl (ELSA-2018-0998) | Nessus | Oracle Linux Local Security Checks | medium |
| 108993 | RHEL 7 : openssl (RHSA-2018:0998) | Nessus | Red Hat Local Security Checks | medium |
| 107232 | AIX OpenSSL Advisory : openssl_advisory25.asc | Nessus | AIX Local Security Checks | medium |
| 106563 | Tenable SecurityCenter OpenSSL 1.0.2 < 1.0.2n Multiple Vulnerabilities | Nessus | Misc. | medium |
| 106547 | openSUSE Security Update : nodejs6 (openSUSE-2018-116) | Nessus | SuSE Local Security Checks | critical |
| 106507 | pfSense 2.3.x < 2.3.5-p1 / 2.4.x < 2.4.2-p1 Multiple Vulnerabilities (SA-17_10 / SA-17_11) | Nessus | Firewalls | medium |
| 106359 | openSUSE Security Update : mysql-community-server (openSUSE-2018-90) | Nessus | SuSE Local Security Checks | high |
| 106102 | MySQL 5.7.x < 5.7.21 Multiple Vulnerabilities (RPM Check) (January 2018 CPU) | Nessus | Databases | medium |
| 106101 | MySQL 5.7.x < 5.7.21 Multiple Vulnerabilities (January 2018 CPU) | Nessus | Databases | medium |
| 106100 | MySQL 5.6.x < 5.6.39 Multiple Vulnerabilities (RPM Check) (January 2018 CPU) | Nessus | Databases | medium |
| 106099 | MySQL 5.6.x < 5.6.39 Multiple Vulnerabilities (January 2018 CPU) | Nessus | Databases | medium |
| 106092 | SUSE SLES12 Security Update : CaaS Platform 2.0 images (SUSE-SU-2018:0053-1) | Nessus | SuSE Local Security Checks | critical |
| 105638 | openSUSE Security Update : nodejs4 (openSUSE-2018-5) | Nessus | SuSE Local Security Checks | critical |
| 105353 | SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2017:3343-1) | Nessus | SuSE Local Security Checks | medium |
| 105341 | openSUSE Security Update : openssl (openSUSE-2017-1381) | Nessus | SuSE Local Security Checks | medium |
| 105329 | Debian DSA-4065-1 : openssl1.0 - security update | Nessus | Debian Local Security Checks | medium |
| 105291 | OpenSSL 1.0.2 < 1.0.2n Multiple Vulnerabilities | Nessus | Web Servers | medium |
| 105263 | GLSA-201712-03 : OpenSSL: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | medium |
| 105173 | Ubuntu 16.04 LTS / 17.04 / 17.10 : openssl vulnerabilities (USN-3512-1) | Nessus | Ubuntu Local Security Checks | medium |
| 105141 | FreeBSD : FreeBSD -- OpenSSL multiple vulnerabilities (9f7a0f39-ddc0-11e7-b5af-a4badb2f4699) | Nessus | FreeBSD Local Security Checks | medium |
| 105113 | Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openssl (SSA:2017-342-01) | Nessus | Slackware Local Security Checks | medium |
| 105090 | FreeBSD : OpenSSL -- multiple vulnerabilities (3bb451fc-db64-11e7-ac58-b499baebfeaf) | Nessus | FreeBSD Local Security Checks | medium |