Detections
Analytics

Alpine: openssl: security update to 1.0.2m-r0

medium Tenable Cloud Security Plugin ID 406083

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte
 overread. This would result in an incorrect text display of the certificate. This bug has been present
 since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. (CVE-2017-3735)

 - There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and
 1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as
 a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH
 are considered just feasible (although very difficult) because most of the work necessary to deduce
 information about a private key may be performed offline. The amount of resources required for such an
 attack would be very significant and likely only accessible to a limited number of attackers. An attacker
 would additionally need online access to an unpatched system using the target private key in a scenario
 with persistent DH parameters and a private key that is shared between multiple clients. This only affects
 processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later
 or AMD Ryzen. (CVE-2017-3736)

See Also

https://security.alpinelinux.org/vuln/CVE-2017-3735

https://security.alpinelinux.org/vuln/CVE-2017-3736

Plugin Details

Severity: Medium

ID: 406083

Version: Revision 1.25

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.2

Percentile: 51.15

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2017-3735

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2017-3736

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 8/28/2017

Reference Information

CVE: CVE-2017-3735, CVE-2017-3736

BID: 100515, 101666

IAVA: 2017-A-0327-S, 2018-A-0118-S