Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2018-0732
HistoryJun 12, 2018 - 1:29 p.m.

CVE-2018-0732

2018-06-1213:29:00
CWE-320
[email protected]
web.nvd.nist.gov
318
3
cve-2018-0732
vulnerability
tls handshake
dh
openssl
denial of service
nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.042 Low

EPSS

Percentile

92.3%

JSON

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Affected configurations

NVD
Node
opensslopensslRange1.0.2–1.0.2o
OR
opensslopensslRange1.1.0–1.1.0h
Node
canonicalubuntu_linuxMatch12.04esm
OR
canonicalubuntu_linuxMatch14.04lts
OR
canonicalubuntu_linuxMatch16.04lts
OR
canonicalubuntu_linuxMatch17.10
OR
canonicalubuntu_linuxMatch18.04lts
OR
debiandebian_linuxMatch8.0
Node
nodejsnode.jsRange6.0.0–6.8.1-
OR
nodejsnode.jsRange6.9.0–6.14.4lts
OR
nodejsnode.jsRange8.0.0–8.8.1-
OR
nodejsnode.jsRange8.9.0–8.11.4lts
OR
nodejsnode.jsRange10.0.0–10.9.0-

CNA Affected

[
  {
    "product": "OpenSSL",
    "vendor": "OpenSSL",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h)"
      },
      {
        "status": "affected",
        "version": "Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o)"
      }
    ]
  }
]

References

Social References

More

Related

suse 9
openvas 36
nessus 60
ibm 43
veracode 2
amazon 2
nvd 1
cvelist 1
f5 1
debiancve 1
hackerone 1
aix 1
symantec 2
tenable 4
prion 1
osv 3
broadcom 2
freebsd 2
gentoo 1
ics 1
checkpoint_advisories 1
alpinelinux 1
openssl 1
ubuntucve 1
redhatcve 1
oraclelinux 4
fedora 2
altlinux 2
mageia 1
slackware 1
redhat 4
debian 2
cloudfoundry 1
ubuntu 2
paloalto 1
suse
suse
Security update for openssl-1_1 (moderate)
2018-10-05 12:08:41
Security update for openssl-1_1 (moderate)
2018-07-28 15:09:18
Security update for openssl (moderate)
2018-07-07 00:09:16
openvas
openvas
openSUSE: Security Advisory for openssl-1_1 (openSUSE-SU-2018:2117-1)
2018-10-26 00:00:00
SUSE: Security Advisory (SUSE-SU-2018:2956-1)
2021-06-09 00:00:00
SUSE: Security Advisory (SUSE-SU-2018:1887-2)
2021-04-19 00:00:00
nessus
nessus
openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-549)
2019-03-27 00:00:00
SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2018:1887-1)
2018-07-06 00:00:00
openSUSE Security Update : openssl-1_1 (openSUSE-2019-751)
2019-03-27 00:00:00
ibm
ibm
Security Bulletin: IBM Flex System switch firmware products are affected by vulnerability in OpenSSL (CVE-2018-0732)
2023-12-07 22:45:03
Security Bulletin: Vulnerability in OpenSSL affects IBM Rational ClearCase (CVE-2018-0732)
2018-11-15 15:50:02
Security Bulletin: Vulnerability in OpenSSL affects IBM BladeCenter Advanced Management Module (AMM)
2018-10-03 16:20:01
veracode
veracode
Denial Of Service (DoS)
2018-06-13 03:48:25
Denial Of Service (DoS)
2019-01-15 09:24:14
amazon
amazon
Medium: openssl
2018-10-30 20:50:00
Medium: openssl
2018-11-07 22:07:00
nvd
nvd
CVE-2018-0732
2018-06-12 13:29:00
cvelist
cvelist
CVE-2018-0732 Client DoS due to large DH parameter
2018-06-12 00:00:00
f5
f5
K21665601 : OpenSSL vulnerability CVE-2018-0732
2018-07-20 00:00:00
debiancve
debiancve
CVE-2018-0732
2018-06-12 13:29:00
hackerone
hackerone
Internet Bug Bounty: Client DoS due to large DH parameter (CVE-2018-0732)
2018-06-12 11:15:31
aix
aix
Vulnerability in OpenSSL affects AIX (CVE-2018-0732)
2018-09-19 08:44:29
symantec
symantec
OpenSSL CVE-2018-0732 Denial of Service Vulnerability
2018-06-12 00:00:00
OpenSSL Vulnerabilities 16-Apr-2018 and 12-Jun-2018
2018-10-10 08:01:01
tenable
tenable
[R1] Nessus 8.0.0 Fixes Multiple Third-party Vulnerabilities
2018-10-23 21:15:12
[R1] Nessus 8.0.0 Fixes Multiple Third-party Vulnerabilities
2018-10-23 21:15:12
[R1] Nessus 7.1.4 Fixes Multiple Third-party Vulnerabilities
2018-12-20 19:43:50
prion
prion
Design/Logic Flaw
2018-06-12 13:29:00
osv
osv
CVE-2018-0732
2018-06-12 13:29:00
openssl - security update
2018-07-28 00:00:00
openssl1.0 - security update
2018-12-19 00:00:00
broadcom
broadcom
CVE-2018-0732. Client DoS due to large DH parameter.
2022-09-13 00:00:00
CVE-2018-0732. Client DoS due to large DH parameter.
2022-09-13 00:00:00
freebsd
freebsd
OpenSSL -- Client DoS due to large DH parameter
2018-06-12 00:00:00
node.js -- multiple vulnerabilities
2018-08-16 00:00:00
gentoo
gentoo
OpenSSL: Denial of service
2018-11-09 00:00:00
ics
ics
Siemens TIM 1531 IRC
2021-06-08 12:00:00
checkpoint_advisories
checkpoint_advisories
OpenSSL Denial of Service (CVE-2018-0732)
2019-02-17 00:00:00
alpinelinux
alpinelinux
CVE-2018-0732
2018-06-12 13:29:00
openssl
openssl
Vulnerability in OpenSSL CVE-2018-0732
2018-06-12 00:00:00
ubuntucve
ubuntucve
CVE-2018-0732
2018-06-12 00:00:00
redhatcve
redhatcve
CVE-2018-0732
2018-06-14 05:18:51
oraclelinux
oraclelinux
openssl security update
2018-10-15 00:00:00
openssl security update
2018-10-12 00:00:00
openssl security update
2018-10-12 00:00:00
fedora
fedora
[SECURITY] Fedora 28 Update: openssl-1.1.0i-1.fc28
2018-09-22 20:52:36
[SECURITY] Fedora 27 Update: openssl-1.1.0i-1.fc27
2018-10-02 15:03:41
altlinux
altlinux
Security fix for the ALT Linux 10 package node version 8.11.4-alt1
2018-08-29 00:00:00
Security fix for the ALT Linux 9 package openssl10 version 1.0.2p-alt1
2018-08-16 00:00:00
mageia
mageia
Updated openssl packages fix security vulnerabilities
2018-09-02 22:07:30
slackware
slackware
[slackware-security] openssl
2018-08-15 00:18:35
redhat
redhat
(RHSA-2018:2552) Moderate: Red Hat OpenShift Application Runtimes Node.js 8.11.4 security update
2018-08-22 21:04:23
(RHSA-2018:2553) Moderate: Red Hat OpenShift Application Runtimes Node.js 10.9.0 security update
2018-08-22 21:04:25
(RHSA-2019:1297) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP2 security update
2019-05-30 14:46:40
debian
debian
[SECURITY] [DLA 1449-1] openssl security update
2018-07-28 03:56:18
[SECURITY] [DSA 4355-1] openssl1.0 security update
2018-12-19 22:29:59
cloudfoundry
cloudfoundry
USN-3692-1: OpenSSL vulnerabilities | Cloud Foundry
2018-07-10 00:00:00
ubuntu
ubuntu
OpenSSL vulnerabilities
2018-06-26 00:00:00
OpenSSL vulnerabilities
2018-06-26 00:00:00
paloalto
paloalto
OpenSSL Vulnerabilities in PAN-OS
2018-10-11 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.6 High

AI Score

Confidence

High

0.042 Low

EPSS

Percentile

92.3%

JSON
Related for CVE-2018-0732
suse9openvas36nessus60ibm43veracode2amazon2nvd1cvelist1f51debiancve1hackerone1aix1symantec2tenable4prion1osv3broadcom2freebsd2gentoo1ics1checkpoint_advisories1alpinelinux1openssl1ubuntucve1redhatcve1oraclelinux4fedora2altlinux2mageia1slackware1redhat4debian2cloudfoundry1ubuntu2paloalto1