OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into the error state and would immediately fail if you attempted to continue the handshake. This works as designed for the explicit handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is subsequently called by the application for the same SSL object then it will succeed and the data is passed without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL 1.0.2n. OpenSSL 1.1.0 is not affected.
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.securityfocus.com/bid/102103
http://www.securitytracker.com/id/1039978
https://access.redhat.com/errata/RHSA-2018:0998
https://access.redhat.com/errata/RHSA-2018:2185
https://access.redhat.com/errata/RHSA-2018:2186
https://access.redhat.com/errata/RHSA-2018:2187
https://cert-portal.siemens.com/productcert/pdf/ssa-179516.pdf
https://github.com/openssl/openssl/commit/898fb884b706aaeb283de4812340bb0bde8476dc
https://security.FreeBSD.org/advisories/FreeBSD-SA-17:12.openssl.asc
https://security.gentoo.org/glsa/201712-03
https://security.netapp.com/advisory/ntap-20171208-0001/
https://security.netapp.com/advisory/ntap-20180117-0002/
https://security.netapp.com/advisory/ntap-20180419-0002/
https://www.debian.org/security/2017/dsa-4065
https://www.digitalmunition.me/2017/12/cve-2017-3737-openssl-security-bypass-vulnerability/
https://www.openssl.org/news/secadv/20171207.txt
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Source: MITRE
Published: 2017-12-07
Updated: 2019-10-03
Type: CWE-125
Base Score: 4.3
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Impact Score: 2.9
Exploitability Score: 8.6
Severity: MEDIUM
Base Score: 5.9
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Impact Score: 3.6
Exploitability Score: 2.2
Severity: MEDIUM
OR
cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2g:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*
OR
ID | Name | Product | Family | Severity |
---|---|---|---|---|
127201 | NewStart CGSL CORE 5.04 / MAIN 5.04 : openssl Multiple Vulnerabilities (NS-SA-2019-0033) | Nessus | NewStart CGSL Local Security Checks | critical |
124999 | EulerOS Virtualization 3.0.1.0 : openssl (EulerOS-SA-2019-1546) | Nessus | Huawei Local Security Checks | medium |
700625 | MySQL 5.7.x < 5.7.21 Multiple Vulnerabilities (January 2018 CPU) | Nessus Network Monitor | Database | medium |
700620 | MySQL 5.6.x < 5.6.39 Multiple Vulnerabilities (January 2018 CPU) | Nessus Network Monitor | Database | medium |
700523 | OpenSSL 1.0.x < 1.0.2n DoS | Nessus Network Monitor | Web Servers | low |
121905 | Photon OS 2.0: Openssl PHSA-2018-2.0-0010-(a) | Nessus | PhotonOS Local Security Checks | medium |
121796 | Photon OS 1.0: Openssl PHSA-2018-1.0-0097-(a) | Nessus | PhotonOS Local Security Checks | medium |
120014 | SUSE SLES12 Security Update : nodejs6 (SUSE-SU-2018:0293-1) | Nessus | SuSE Local Security Checks | medium |
120012 | SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2018:0002-1) | Nessus | SuSE Local Security Checks | medium |
111908 | Photon OS 1.0: Openssl PHSA-2018-1.0-0097-(a) (deprecated) | Nessus | PhotonOS Local Security Checks | medium |
111600 | MySQL Enterprise Monitor 3.3.x < 3.3.9.3339 / 3.4.x < 3.4.7.4296 / 4.0.x < 4.0.4.5233 Multiple Vulnerabilities (April 2018 CPU) | Nessus | CGI abuses | medium |
111279 | Photon OS 2.0 : openssl (PhotonOS-PHSA-2018-2.0-0010-(a)) (deprecated) | Nessus | PhotonOS Local Security Checks | medium |
111147 | RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 (RHSA-2018:2186) | Nessus | Red Hat Local Security Checks | high |
111146 | RHEL 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 (RHSA-2018:2185) | Nessus | Red Hat Local Security Checks | high |
110843 | EulerOS 2.0 SP3 : openssl (EulerOS-SA-2018-1179) | Nessus | Huawei Local Security Checks | medium |
109698 | Amazon Linux AMI : openssl (ALAS-2018-1016) | Nessus | Amazon Linux Local Security Checks | medium |
109513 | EulerOS 2.0 SP2 : openssl (EulerOS-SA-2018-1115) | Nessus | Huawei Local Security Checks | medium |
109455 | Scientific Linux Security Update : openssl on SL7.x x86_64 (20180410) | Nessus | Scientific Linux Local Security Checks | medium |
109406 | Juniper NSM < 2012.2R14 OpenSSL Multiple Vulnerabilities (JSA10851) | Nessus | Misc. | medium |
109379 | CentOS 7 : openssl (CESA-2018:0998) | Nessus | CentOS Local Security Checks | medium |
109364 | Amazon Linux 2 : openssl (ALAS-2018-1004) | Nessus | Amazon Linux Local Security Checks | medium |
109294 | openSUSE Security Update : virtualbox (openSUSE-2018-389) (Optionsbleed) | Nessus | SuSE Local Security Checks | medium |
109165 | Oracle Secure Global Desktop Multiple Vulnerabilities (April 2018 CPU) | Nessus | Misc. | medium |
109112 | Oracle Linux 7 : openssl (ELSA-2018-0998) | Nessus | Oracle Linux Local Security Checks | medium |
108993 | RHEL 7 : openssl (RHSA-2018:0998) | Nessus | Red Hat Local Security Checks | medium |
107232 | AIX OpenSSL Advisory : openssl_advisory25.asc | Nessus | AIX Local Security Checks | medium |
106563 | Tenable SecurityCenter OpenSSL 1.0.2 < 1.0.2n Multiple Vulnerabilities | Nessus | Misc. | medium |
106547 | openSUSE Security Update : nodejs6 (openSUSE-2018-116) | Nessus | SuSE Local Security Checks | medium |
106507 | pfSense 2.3.x < 2.3.5-p1 / 2.4.x < 2.4.2-p1 Multiple Vulnerabilities (SA-17_10 / SA-17_11) | Nessus | Firewalls | medium |
106359 | openSUSE Security Update : mysql-community-server (openSUSE-2018-90) | Nessus | SuSE Local Security Checks | high |
106102 | MySQL 5.7.x < 5.7.21 Multiple Vulnerabilities (RPM Check) (January 2018 CPU) | Nessus | Databases | high |
106101 | MySQL 5.7.x < 5.7.21 Multiple Vulnerabilities (January 2018 CPU) | Nessus | Databases | high |
106100 | MySQL 5.6.x < 5.6.39 Multiple Vulnerabilities (RPM Check) (January 2018 CPU) | Nessus | Databases | high |
106099 | MySQL 5.6.x < 5.6.39 Multiple Vulnerabilities (January 2018 CPU) | Nessus | Databases | high |
106092 | SUSE SLES12 Security Update : CaaS Platform 2.0 images (SUSE-SU-2018:0053-1) | Nessus | SuSE Local Security Checks | high |
105638 | openSUSE Security Update : nodejs4 (openSUSE-2018-5) | Nessus | SuSE Local Security Checks | medium |
105353 | SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2017:3343-1) | Nessus | SuSE Local Security Checks | medium |
105341 | openSUSE Security Update : openssl (openSUSE-2017-1381) | Nessus | SuSE Local Security Checks | medium |
105329 | Debian DSA-4065-1 : openssl1.0 - security update | Nessus | Debian Local Security Checks | medium |
105291 | OpenSSL 1.0.2 < 1.0.2n Multiple Vulnerabilities | Nessus | Web Servers | medium |
105263 | GLSA-201712-03 : OpenSSL: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | medium |
105173 | Ubuntu 16.04 LTS / 17.04 / 17.10 : openssl vulnerabilities (USN-3512-1) | Nessus | Ubuntu Local Security Checks | medium |
105141 | FreeBSD : FreeBSD -- OpenSSL multiple vulnerabilities (9f7a0f39-ddc0-11e7-b5af-a4badb2f4699) | Nessus | FreeBSD Local Security Checks | medium |
105113 | Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : openssl (SSA:2017-342-01) | Nessus | Slackware Local Security Checks | medium |
105090 | FreeBSD : OpenSSL -- multiple vulnerabilities (3bb451fc-db64-11e7-ac58-b499baebfeaf) | Nessus | FreeBSD Local Security Checks | medium |