K08044291 : OpenSSL vulnerability CVE-2018-0739

Security Advisory Description

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n). (CVE-2018-0739)

Impact

BIG-IP / BIG-IQ / F5 iWorkflow / Enterprise Manager / Traffix SDC

When a carefully crafted malicious ASN.1 structure is loaded by an authenticated administrative user using the OpenSSL command line utility, the command line utility may stop responding. This vulnerability does not affect X.509 certificates, SSL profiles, or SSL/TLS connections.

ARX / LineRate

There is no impact; F5 products are not affected by this vulnerability.