CVE-2018-0739

Updated: 2023-11-07 19:55:38.347558

Description:

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x MEDIUM 4.3
CVSS Version 3.x MEDIUM 6.5

Status

OS name Project name Version Score Severity Status Errata Last updated
CentOS 6 ELS openssl 1.0.1e 6.5 MEDIUM Released CLSA-2021:1632262317 2022-05-05 12:01:46
CloudLinux 6 ELS openssl 1.0.1e 6.5 MEDIUM Released 2021-11-02 14:03:17
Oracle Linux 6 ELS openssl 1.0.1e 6.5 MEDIUM Not Vulnerable CLSA-2021:1634922881 2021-11-02 14:03:17
Ubuntu 16.04 ELS openssl 1.0.2g-1 6.5 MEDIUM Not Vulnerable 2021-11-02 14:03:17