CVE-2018-0732

    Dashboard / Vulnerabilities / CVE-2018-0732

    CVE-2018-0732

    Published: 12 Jun 2018Last Modified: 8 Jul 2026

    Summary:

    Details: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

    References: https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098, https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/, http://www.securityfocus.com/bid/104442, http://www.securitytracker.com/id/1041090, https://access.redhat.com/errata/RHSA-2018:2552, https://access.redhat.com/errata/RHSA-2018:2553, https://access.redhat.com/errata/RHSA-2018:3221, https://access.redhat.com/errata/RHSA-2018:3505, https://access.redhat.com/errata/RHSA-2019:1296, https://access.redhat.com/errata/RHSA-2019:1297, https://access.redhat.com/errata/RHSA-2019:1543, https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf, https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html, https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/, https://security.gentoo.org/glsa/201811-03, https://security.netapp.com/advisory/ntap-20181105-0001/, https://security.netapp.com/advisory/ntap-20190118-0002/, https://securityadvisories.paloaltonetworks.com/Home/Detail/133, https://usn.ubuntu.com/3692-1/, https://usn.ubuntu.com/3692-2/, https://www.debian.org/security/2018/dsa-4348, https://www.debian.org/security/2018/dsa-4355, https://www.openssl.org/news/secadv/20180612.txt, https://www.oracle.com/security-alerts/cpuapr2020.html, https://www.oracle.com/security-alerts/cpujan2021.html, https://www.tenable.com/security/tns-2018-12, https://www.tenable.com/security/tns-2018-13, https://www.tenable.com/security/tns-2018-14, https://www.tenable.com/security/tns-2018-17, http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html, https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html, https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html, https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html, https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ce3e3c5fe15479475c068482c48eb9cbf1ac9df5
    Fixed -c6a397bce63fc026421e1515b98eec9b8b5a8468

    Affected versions

    v10.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-0732 | CVE-DB