cbcvebase.
CVE-2018-0739
published 2018-03-27

CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive…

PriorityP341medium6.5CVSS 3.0
AVNACLPRNUIRSUCNINAH
EPSS
19.30%
97.0th percentile
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

Affected

21 ranges
VendorProductVersion rangeFixed in
canonicalubuntu_linux——
canonicalubuntu_linux——
canonicalubuntu_linux——
debiandebian_linux——
debiandebian_linux——
debiandebian_linux——
debianlibtomcrypt< libtomcrypt 1.18.2-1 (bookworm)libtomcrypt 1.18.2-1 (bookworm)
debianopenssl< libtomcrypt 1.18.2-1 (bookworm)libtomcrypt 1.18.2-1 (bookworm)
libtomcryptlibtomcrypt>= 0 < 1.18.2-11.18.2-1
libtomcryptlibtomcrypt>= 0 < 1.18.2-11.18.2-1
libtomcryptlibtomcrypt>= 0 < 1.18.2-11.18.2-1
libtomcryptlibtomcrypt>= 0 < 1.18.2-11.18.2-1
opensslopenssl——
opensslopenssl——
opensslopenssl>= 0 < 1.1.0h-11.1.0h-1
opensslopenssl>= 0 < 1.1.0h-11.1.0h-1
opensslopenssl>= 0 < 1.1.0h-11.1.0h-1
opensslopenssl>= 0 < 1.1.0h-11.1.0h-1
opensslopenssl1.0.2b – 1.0.2n—
opensslopenssl1.1.0 – 1.1.0g—
paloaltopan-os——

CVSS provenance

nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
osv6.5MEDIUM
vendor_debian6.5LOW
vendor_oracle6.5MEDIUM
vendor_redhat6.5MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.