Details of VAR-201705-3649

ID

VAR-201705-3649

CVE

CVE-2017-3732

TITLE

OpenSSL Service disruption in (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2017-003156

DESCRIPTION

There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem. OpenSSL There is a service disruption ( crash ) There are vulnerabilities that are put into a state.Service operation interruption ( crash ) There is a possibility of being put into a state. OpenSSL Security Advisory [26 Jan 2017] ======================================== Truncated packet could crash via OOB read (CVE-2017-3731) ========================================================= Severity: Moderate If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k This issue was reported to OpenSSL on 13th November 2016 by Robert Święcki of Google. The fix was developed by Andy Polyakov of the OpenSSL development team. Bad (EC)DHE parameters cause a client crash (CVE-2017-3730) =========================================================== Severity: Moderate If a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack. OpenSSL 1.1.0 users should upgrade to 1.1.0d This issue does not affect OpenSSL version 1.0.2. This means the git commit with the fix does not contain the CVE identifier. The relevant fix commit can be identified by commit hash efbe126e3. This issue was reported to OpenSSL on 14th January 2017 by Guido Vranken. The fix was developed by Matt Caswell of the OpenSSL development team. UPDATE 31 Jan 2017. This is not true. OpenSSL 1.1.0 users should upgrade to 1.1.0d OpenSSL 1.0.2 users should upgrade to 1.0.2k This issue was reported to OpenSSL on 15th January 2017 by the OSS-Fuzz project. The fix was developed by Andy Polyakov of the OpenSSL development team. Montgomery multiplication may produce incorrect results (CVE-2016-7055) ======================================================================= Severity: Low This issue was previously fixed in 1.1.0c and covered in security advisory https://www.openssl.org/news/secadv/20161110.txt OpenSSL 1.0.2 users should upgrade to 1.0.2k Note ==== Support for version 1.0.1 ended on 31st December 2016. Support for versions 0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer receiving security updates. References ========== URL for this Security Advisory: https://www.openssl.org/news/secadv/20170126.txt Note: the online version of the advisory may be updated with additional details over time. For details of OpenSSL severity classifications please see: https://www.openssl.org/policies/secpolicy.html . OpenSSL Security Advisory [27 Mar 2018] ======================================== Constructed ASN.1 types with a recursive definition could exceed the stack (CVE-2018-0739) ========================================================================================== Severity: Moderate Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) ========================================================= Severity: Low This issue has been reported in a previous OpenSSL security advisory and a fix was provided for OpenSSL 1.0.2. This only affects processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). The issue was originally found via the OSS-Fuzz project. Solution: The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Web Server installation (including all applications and configuration files). After installing the updated packages, the httpd daemon will be restarted automatically. Description: This release adds the new Apache HTTP Server 2.4.29 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release. This release upgrades OpenSSL to version 1.0.2.n Security Fix(es): * openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() (CVE-2016-2182) * openssl: Insufficient TLS session ticket HMAC length checks (CVE-2016-6302) * openssl: certificate message OOB reads (CVE-2016-6306) * openssl: Carry propagating bug in Montgomery multiplication (CVE-2016-7055) * openssl: Truncated packet could crash via OOB read (CVE-2017-3731) * openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732) * openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736) * openssl: Read/write after SSL object in error state (CVE-2017-3737) * openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6306 and CVE-2016-7055. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. Bugs fixed (https://bugzilla.redhat.com/): 1367340 - CVE-2016-2182 openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() 1369855 - CVE-2016-6302 openssl: Insufficient TLS session ticket HMAC length checks 1377594 - CVE-2016-6306 openssl: certificate message OOB reads 1393929 - CVE-2016-7055 openssl: Carry propagating bug in Montgomery multiplication 1416852 - CVE-2017-3731 openssl: Truncated packet could crash via OOB read 1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64 1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64 1523504 - CVE-2017-3737 openssl: Read/write after SSL object in error state 1523510 - CVE-2017-3738 openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 6. JIRA issues fixed (https://issues.jboss.org/): JBCS-373 - Errata for httpd 2.4.29 GA RHEL 7 7. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: java-1.8.0-ibm security update Advisory ID: RHSA-2018:2568-01 Product: Red Hat Enterprise Linux Supplementary Advisory URL: https://access.redhat.com/errata/RHSA-2018:2568 Issue date: 2018-08-27 CVE Names: CVE-2016-0705 CVE-2017-3732 CVE-2017-3736 CVE-2018-1517 CVE-2018-1656 CVE-2018-2940 CVE-2018-2952 CVE-2018-2973 CVE-2018-12539 ===================================================================== 1. Summary: An update for java-1.8.0-ibm is now available for Red Hat Enterprise Linux 7 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client Supplementary (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Supplementary (v. 7) - x86_64 Red Hat Enterprise Linux Server Supplementary (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation Supplementary (v. 7) - x86_64 3. Description: IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to version 8 SR5-FP20. Security Fix(es): * IBM JDK: privilege escalation via insufficiently restricted access to Attach API (CVE-2018-12539) * openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732) * openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736) * IBM JDK: DoS in the java.math component (CVE-2018-1517) * IBM JDK: path traversal flaw in the Diagnostic Tooling Framework (CVE-2018-1656) * Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries) (CVE-2018-2940) * OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547) (CVE-2018-2952) * Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE) (CVE-2018-2973) * OpenSSL: Double-free in DSA code (CVE-2016-0705) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank the OpenSSL project for reporting CVE-2016-0705. Upstream acknowledges Adam Langley (Google/BoringSSL) as the original reporter of CVE-2016-0705. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running instances of IBM Java must be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1310596 - CVE-2016-0705 OpenSSL: Double-free in DSA code 1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64 1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64 1600925 - CVE-2018-2952 OpenJDK: insufficient index validation in PatternSyntaxException getMessage() (Concurrency, 8199547) 1602145 - CVE-2018-2973 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (JSSE) 1602146 - CVE-2018-2940 Oracle JDK: unspecified vulnerability fixed in 6u201, 7u191, 8u181, and 10.0.2 (Libraries) 1618767 - CVE-2018-12539 IBM JDK: privilege escalation via insufficiently restricted access to Attach API 1618869 - CVE-2018-1656 IBM JDK: path traversal flaw in the Diagnostic Tooling Framework 1618871 - CVE-2018-1517 IBM JDK: DoS in the java.math component 6. Package List: Red Hat Enterprise Linux Client Supplementary (v. 7): x86_64: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Supplementary (v. 7): x86_64: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm Red Hat Enterprise Linux Server Supplementary (v. 7): ppc64: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.ppc64.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64.rpm ppc64le: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.ppc64le.rpm s390x: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.s390x.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.s390x.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.s390x.rpm java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.s390x.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.s390x.rpm x86_64: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Supplementary (v. 7): x86_64: java-1.8.0-ibm-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-demo-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-devel-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-jdbc-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-plugin-1.8.0.5.20-1jpp.1.el7.x86_64.rpm java-1.8.0-ibm-src-1.8.0.5.20-1jpp.1.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-0705 https://access.redhat.com/security/cve/CVE-2017-3732 https://access.redhat.com/security/cve/CVE-2017-3736 https://access.redhat.com/security/cve/CVE-2018-1517 https://access.redhat.com/security/cve/CVE-2018-1656 https://access.redhat.com/security/cve/CVE-2018-2940 https://access.redhat.com/security/cve/CVE-2018-2952 https://access.redhat.com/security/cve/CVE-2018-2973 https://access.redhat.com/security/cve/CVE-2018-12539 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW4QI1dzjgjWX9erEAQgiBRAApZ4yMTz6VaYwLOqGPcoQdZzEkg64CARM k1LrzpzgD6tRbaKya/LqvJvIhQlJ4LWs0AAlOM0VNrwdx8ntZ4lGHURqSM1Y14L/ TScLgA22CTbL4u+8BEOrsNCcjnp+5YALbfPv1DCdYvbRwi1J503w4ccwBfttb+1/ EaYh7nrWooa6R6qlkopmk1zprZGCgv3azYOqphcnrooeCC3ZqcBEWZNo/H1TnxWv kXfgxmZS3Rq5399umMOuWh2HDme2tO1OWTdY1+REfZh0Ex5v1rqYm/s+8d2FrEWm Oqk5Azstjt/l5OZfVg/WJd/iy1ob2m5yRUp5mhLFfkctIN/stxqbqLzO17dimdEn mhBwG/IkaGkMqQgEEZ65SXNyS+kW7hS8P4F0BuzmHIfaO3ALpCWOczyyiKHPHMng ZPYeV+roqRVeZ7TY8dfcUOh3eOKivfQBL921x4YdciCgPxBR7eRx8/aw8QL7VFot CRFMkS36Q2YqgfP9XH06AZdUEVJp/dpB1/f+EtR8e6YDdHSSgJvoV9pP0S2DhWnA o5V5efe12Jv3MQgiy5n0Ws4/mhcxthZSTcdBKQfyTsfqngCr1TTnGotN9GI1B0qe XX7pry5RkLnq/l/0T4d6JJceMnK5n/DebajHM+4B1rWQZS+4KUPDN5rYuo4OkI6L KZ2NcbK0Lfw= =5oM3 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 6) - i386, x86_64 3

Trust: 2.43

sources: NVD: CVE-2017-3732 // JVNDB: JVNDB-2017-003156 // VULMON: CVE-2017-3732 // PACKETSTORM: 169650 // PACKETSTORM: 169631 // PACKETSTORM: 169626 // PACKETSTORM: 148521 // PACKETSTORM: 148525 // PACKETSTORM: 148524 // PACKETSTORM: 149110 // PACKETSTORM: 149130

AFFECTED PRODUCTS

vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2a	Trust: 1.6
vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2d	Trust: 1.6
vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2b	Trust: 1.6
vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2e	Trust: 1.6
vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2c	Trust: 1.6
vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2f	Trust: 1.6
vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2	Trust: 1.6
vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2h	Trust: 1.0
vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2i	Trust: 1.0
vendor:	openssl	model:	openssl	scope:	eq	version:	1.1.0c	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lt	version:	6.9.5	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lte	version:	6.8.1	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lte	version:	4.1.2	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lt	version:	7.5.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	6.9.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	4.2.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	6.0.0	Trust: 1.0
vendor:	openssl	model:	openssl	scope:	eq	version:	1.1.0b	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lt	version:	4.7.3	Trust: 1.0
vendor:	openssl	model:	openssl	scope:	eq	version:	1.1.0a	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	7.0.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	4.0.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	gte	version:	5.0.0	Trust: 1.0
vendor:	nodejs	model:	node.js	scope:	lte	version:	5.12.0	Trust: 1.0
vendor:	hitachi	model:	jp1/automatic job management system 3	scope:	eq	version:	- manager web console	Trust: 0.8
vendor:	hitachi	model:	jp1/integrated management	scope:	eq	version:	- service support starter edition	Trust: 0.8
vendor:	openssl	model:	openssl	scope:	eq	version:	1.1.0d	Trust: 0.8
vendor:	hitachi	model:	jp1/it desktop management	scope:	eq	version:	2 - operations director	Trust: 0.8
vendor:	hitachi	model:	ucosminexus application server	scope:	eq	version:	(64)	Trust: 0.8
vendor:	openssl	model:	openssl	scope:	lt	version:	1.1.0	Trust: 0.8
vendor:	nec	model:	systemdirector enterprise	scope:	-	version:	-	Trust: 0.8
vendor:	nec	model:	enterprisedirectoryserver	scope:	eq	version:	all versions	Trust: 0.8
vendor:	hitachi	model:	job management partner 1/integrated management	scope:	eq	version:	- service support	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	foundation	Trust: 0.8
vendor:	hitachi	model:	job management partner 1/it desktop management	scope:	eq	version:	2 - smart device manager	Trust: 0.8
vendor:	hitachi	model:	jp1/performance management	scope:	eq	version:	- web console	Trust: 0.8
vendor:	nec	model:	express5800	scope:	eq	version:	/sg all versions	Trust: 0.8
vendor:	nec	model:	webotx enterprise service bus	scope:	-	version:	-	Trust: 0.8
vendor:	openssl	model:	openssl	scope:	eq	version:	1.0.2k	Trust: 0.8
vendor:	hitachi	model:	ucosminexus service platform	scope:	eq	version:	(64)	Trust: 0.8
vendor:	hitachi	model:	jp1/performance management	scope:	eq	version:	- manager	Trust: 0.8
vendor:	hitachi	model:	jp1/it desktop management - manager	scope:	-	version:	-	Trust: 0.8
vendor:	hitachi	model:	jp1/automatic operation	scope:	-	version:	-	Trust: 0.8
vendor:	hitachi	model:	job management partner 1/performance management - web console	scope:	-	version:	-	Trust: 0.8
vendor:	hitachi	model:	job management partner 1/it desktop management	scope:	eq	version:	2 - manager	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	st ard	Trust: 0.8
vendor:	hitachi	model:	ucosminexus application server	scope:	eq	version:	none	Trust: 0.8
vendor:	hitachi	model:	jp1/it desktop management	scope:	eq	version:	2 - smart device manager	Trust: 0.8
vendor:	hitachi	model:	jp1/integrated management	scope:	eq	version:	- service support	Trust: 0.8
vendor:	hitachi	model:	ucosminexus primary server	scope:	eq	version:	base	Trust: 0.8
vendor:	hitachi	model:	ucosminexus primary server	scope:	eq	version:	base(64)	Trust: 0.8
vendor:	hitachi	model:	job management partner 1/integrated management	scope:	eq	version:	- service support advanced edition	Trust: 0.8
vendor:	hitachi	model:	ucosminexus service platform	scope:	eq	version:	none	Trust: 0.8
vendor:	hitachi	model:	it operations director	scope:	-	version:	-	Trust: 0.8
vendor:	hitachi	model:	jp1/service support	scope:	eq	version:	none	Trust: 0.8
vendor:	hitachi	model:	jp1/operations analytics	scope:	-	version:	-	Trust: 0.8
vendor:	hitachi	model:	jp1/service support	scope:	eq	version:	starter edition	Trust: 0.8
vendor:	hitachi	model:	cosminexus http server	scope:	-	version:	-	Trust: 0.8
vendor:	hitachi	model:	ucosminexus application server	scope:	eq	version:	-r	Trust: 0.8
vendor:	hitachi	model:	jp1/it desktop management	scope:	eq	version:	2 - manager	Trust: 0.8
vendor:	hitachi	model:	job management partner 1/it desktop management - manager	scope:	-	version:	-	Trust: 0.8
vendor:	hitachi	model:	ucosminexus service architect	scope:	-	version:	-	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	express	Trust: 0.8
vendor:	nec	model:	esmpro/serveragentservice	scope:	eq	version:	all versions (linux edition )	Trust: 0.8
vendor:	hitachi	model:	jp1/performance management	scope:	eq	version:	- manager web console	Trust: 0.8
vendor:	openssl	model:	openssl	scope:	lt	version:	1.0.2	Trust: 0.8
vendor:	nec	model:	webotx portal	scope:	-	version:	-	Trust: 0.8
vendor:	hitachi	model:	ucosminexus developer	scope:	-	version:	-	Trust: 0.8
vendor:	nec	model:	webotx application server	scope:	eq	version:	enterprise	Trust: 0.8
vendor:	hitachi	model:	jp1/integrated management	scope:	eq	version:	- service support advanced edition	Trust: 0.8

sources: JVNDB: JVNDB-2017-003156 // CNNVD: CNNVD-201702-216 // NVD: CVE-2017-3732

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-3732
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-3732
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201702-216
value:	MEDIUM
Trust: 0.6
VULMON:	CVE-2017-3732
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-3732
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

nvd@nist.gov:	CVE-2017-3732
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.2
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2017-3732
baseSeverity:	MEDIUM
baseScore:	5.9
vectorString:	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULMON: CVE-2017-3732 // JVNDB: JVNDB-2017-003156 // CNNVD: CNNVD-201702-216 // NVD: CVE-2017-3732

PROBLEMTYPE DATA

problemtype:

CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2017-003156 // NVD: CVE-2017-3732

THREAT TYPE

remote

Trust: 0.8

sources: PACKETSTORM: 148525 // PACKETSTORM: 148524 // CNNVD: CNNVD-201702-216

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201702-216

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-003156

PATCH

title:	hitachi-sec-2018-103	url:	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2018-103/index.html	Trust: 0.8
title:	hitachi-sec-2017-115	url:	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-115/index.html	Trust: 0.8
title:	NV17-011	url:	http://jpn.nec.com/security-info/secinfo/nv17-011.html	Trust: 0.8
title:	BN_mod_exp may produce incorrect results on x86_64	url:	https://www.openssl.org/news/secadv/20170126.txt	Trust: 0.8
title:	hitachi-sec-2018-103	url:	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2018-103/index.html	Trust: 0.8
title:	hitachi-sec-2017-115	url:	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-115/index.html	Trust: 0.8
title:	OpenSSL Repair measures for information disclosure vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=67520	Trust: 0.6
title:	The Register	url:	https://www.theregister.co.uk/2017/01/31/openssl_patches/	Trust: 0.2
title:	Red Hat: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20182185 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: java-1.8.0-ibm security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20182575 - Security Advisory	Trust: 0.1
title:	Red Hat: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20182186 - Security Advisory	Trust: 0.1
title:	Red Hat: Moderate: java-1.8.0-ibm security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20182713 - Security Advisory	Trust: 0.1
title:	Red Hat: Important: java-1.8.0-ibm security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20182568 - Security Advisory	Trust: 0.1
title:	Red Hat: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 security update	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20182187 - Security Advisory	Trust: 0.1
title:	Red Hat: CVE-2017-3732	url:	https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2017-3732	Trust: 0.1
title:	Arch Linux Issues:	url:	https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2017-3732	Trust: 0.1
title:	IBM: Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Connect 3.7.4 and earlier (CVE-2017-3732, CVE-2016-7055)	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=030cb7ac9266aec85453c1d2339fbc00	Trust: 0.1
title:	Ubuntu Security Notice: openssl vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3181-1	Trust: 0.1
title:	Arch Linux Advisories: [ASA-201701-37] openssl: multiple issues	url:	https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201701-37	Trust: 0.1
title:	Huawei Security Advisories: Security Advisory - Three OpenSSL Vulnerabilities in Huawei Products	url:	https://vulmon.com/vendoradvisory?qidtp=huawei_security_advisories&qid=1181e052a6a83786d4182d45ddb56d5d	Trust: 0.1
title:	Symantec Security Advisories: SA141 : OpenSSL Vulnerabilities 26-Jan-2017	url:	https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories&qid=117bc0d26e74d755d85acf15af842eaf	Trust: 0.1
title:	Arch Linux Advisories: [ASA-201701-36] lib32-openssl: multiple issues	url:	https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201701-36	Trust: 0.1
title:	IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2016-0705, CVE-2017-3732, CVE-2017-3736, CVE-2018-1656, CVE-2018-12539)	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=3d9ab13c871ea2142681c7977b25c5ff	Trust: 0.1
title:	IBM: IBM Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU – Jul 2018 – Includes Oracle Jul 2018 CPU affects DB2 Recovery Expert for Linux, Unix and Windows	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=af4ddb95056d65a4af347aec0f652f0e	Trust: 0.1
title:	Cisco: Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: January and February 2017	url:	https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20170130-openssl	Trust: 0.1
title:	IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Planning	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=62ef85c9034c17315b7d0a712483c5ea	Trust: 0.1
title:	IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Reporting for Development Intelligence	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=03b0267d78cd8ac1bbb43afc737474f0	Trust: 0.1
title:	IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM InfoSphere Information Server	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=63bbfc68418161b36080acd59a541d45	Trust: 0.1
title:	IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Privileged Identity Manager	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=42a34f9348fc5f34065c6d25764eb2a2	Trust: 0.1
title:	Debian CVElist Bug Report Logs: Security fixes from the July 2017 CPU	url:	https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs&qid=adc1e0c986afd5f2f3b0797ba936d072	Trust: 0.1
title:	IBM: IBM Security Bulletin: IBM Cognos Controller 2019Q2 Security Updater: Multiple vulnerabilities have been identified in IBM Cognos Controller	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=38227211accce022b0a3d9b56a974186	Trust: 0.1
title:	Forcepoint Security Advisories: CVE-2017-3730, -3731, -3732 OpenSSL Vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=forcepoint_security_advisories&qid=16a227df38f44014c9520f3b6cb5344e	Trust: 0.1
title:	Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2017	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=a2bac27fb002bed513645d4775c7275b	Trust: 0.1
title:	Tenable Security Advisories: [R5] SecurityCenter 5.4.3 Fixes Multiple Vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories&qid=TNS-2017-04	Trust: 0.1
title:	Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - April 2017	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=a31bff03e9909229fd67996884614fdf	Trust: 0.1
title:	Oracle: Oracle Critical Patch Update Advisory - July 2017	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=2f446a7e1ea263c0c3a365776c6713f2	Trust: 0.1
title:	Oracle: Oracle Critical Patch Update Advisory - July 2018	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=5f8c525f1408011628af1792207b2099	Trust: 0.1
title:	Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2018	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=586e6062440cdd312211d748e028164e	Trust: 0.1
title:	IBM: IBM Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple vulnerabilities	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=dd8c9d5928cc3b1ac8c35b4b24703e38	Trust: 0.1
title:	Oracle: Oracle Critical Patch Update Advisory - April 2017	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=143b3fb255063c81571469eaa3cf0a87	Trust: 0.1
title:	Oracle: Oracle Critical Patch Update Advisory - October 2017	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=523d3f220a64ff01dd95e064bd37566a	Trust: 0.1
title:	Oracle: Oracle Critical Patch Update Advisory - January 2018	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=e2a7f287e9acc8c64ab3df71130bc64d	Trust: 0.1
title:	IBM: Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM Netezza Analytics for NPS	url:	https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=c36fc403a4c2c6439b732d2fca738f58	Trust: 0.1
title:	Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2018	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=525e4e31765e47b9e53b24e880af9d6e	Trust: 0.1
title:	Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - October 2017	url:	https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=6283337cd31f81f24d445925f2138c0e	Trust: 0.1

sources: VULMON: CVE-2017-3732 // JVNDB: JVNDB-2017-003156 // CNNVD: CNNVD-201702-216

EXTERNAL IDS

db:	NVD	id:	CVE-2017-3732	Trust: 3.3
db:	SECTRACK	id:	1037717	Trust: 1.7
db:	BID	id:	95814	Trust: 1.7
db:	TENABLE	id:	TNS-2017-04	Trust: 1.7
db:	JVN	id:	JVNVU92830136	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-003156	Trust: 0.8
db:	AUSCERT	id:	ESB-2022.0696	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.1415	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.4325	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.0258.3	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.1613	Trust: 0.6
db:	AUSCERT	id:	ESB-2019.0733	Trust: 0.6
db:	CNNVD	id:	CNNVD-201702-216	Trust: 0.6
db:	VULMON	id:	CVE-2017-3732	Trust: 0.1
db:	PACKETSTORM	id:	169650	Trust: 0.1
db:	PACKETSTORM	id:	169631	Trust: 0.1
db:	PACKETSTORM	id:	169626	Trust: 0.1
db:	PACKETSTORM	id:	148521	Trust: 0.1
db:	PACKETSTORM	id:	148525	Trust: 0.1
db:	PACKETSTORM	id:	148524	Trust: 0.1
db:	PACKETSTORM	id:	149110	Trust: 0.1
db:	PACKETSTORM	id:	149130	Trust: 0.1

sources: VULMON: CVE-2017-3732 // JVNDB: JVNDB-2017-003156 // PACKETSTORM: 169650 // PACKETSTORM: 169631 // PACKETSTORM: 169626 // PACKETSTORM: 148521 // PACKETSTORM: 148525 // PACKETSTORM: 148524 // PACKETSTORM: 149110 // PACKETSTORM: 149130 // CNNVD: CNNVD-201702-216 // NVD: CVE-2017-3732

REFERENCES

url:	http://www.securityfocus.com/bid/95814	Trust: 2.3
url:	https://www.openssl.org/news/secadv/20170126.txt	Trust: 1.8
url:	https://access.redhat.com/errata/rhsa-2018:2187	Trust: 1.8
url:	https://access.redhat.com/errata/rhsa-2018:2186	Trust: 1.8
url:	https://access.redhat.com/errata/rhsa-2018:2185	Trust: 1.8
url:	https://access.redhat.com/errata/rhsa-2018:2568	Trust: 1.8
url:	https://access.redhat.com/errata/rhsa-2018:2575	Trust: 1.8
url:	https://security.gentoo.org/glsa/201702-07	Trust: 1.7
url:	http://www.securitytracker.com/id/1037717	Trust: 1.7
url:	http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html	Trust: 1.7
url:	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	Trust: 1.7
url:	https://www.tenable.com/security/tns-2017-04	Trust: 1.7
url:	https://security.freebsd.org/advisories/freebsd-sa-17:02.openssl.asc	Trust: 1.7
url:	http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	Trust: 1.7
url:	https://github.com/openssl/openssl/commit/a59b90bf491410f1f2bc4540cc21f1980fd14c5b	Trust: 1.7
url:	https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us&docid=emr_na-hpesbhf03838en_us	Trust: 1.7
url:	https://access.redhat.com/errata/rhsa-2018:2713	Trust: 1.7
url:	https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3732	Trust: 1.6
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3732	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu92830136/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3736	Trust: 0.7
url:	http://www.ibm.com/support/docview.wss?uid=ibm10715641	Trust: 0.6
url:	http://www.ibm.com/support/docview.wss?uid=ibm10871356	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2022.0696	Trust: 0.6
url:	https://www-01.ibm.com/support/docview.wss?uid=ibm10882734	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/76710	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2019.4325/	Trust: 0.6
url:	https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics/	Trust: 0.6
url:	https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics-for-nps/	Trust: 0.6
url:	https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-jre-8-0-1-1-affect-ibm-netezza-platform-software-clients/	Trust: 0.6
url:	http://www.ibm.com/support/docview.wss?uid=ibm10882292	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/80494	Trust: 0.6
url:	http://www.ibm.com/support/docview.wss?uid=ibm10882754	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/79678	Trust: 0.6
url:	https://www.ibm.com/support/pages/node/1106811	Trust: 0.6
url:	http://www.ibm.com/support/docview.wss?uid=ibm10734877	Trust: 0.6
url:	https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20170503-01-openssl-cn	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/74714	Trust: 0.6
url:	https://access.redhat.com/security/team/contact/	Trust: 0.5
url:	https://www.redhat.com/mailman/listinfo/rhsa-announce	Trust: 0.5
url:	https://access.redhat.com/security/cve/cve-2017-3732	Trust: 0.5
url:	https://bugzilla.redhat.com/):	Trust: 0.5
url:	https://access.redhat.com/security/cve/cve-2017-3736	Trust: 0.5
url:	https://nvd.nist.gov/vuln/detail/cve-2016-7055	Trust: 0.4
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3731	Trust: 0.4
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3738	Trust: 0.4
url:	https://access.redhat.com/articles/11258	Trust: 0.4
url:	https://access.redhat.com/security/team/key/	Trust: 0.4
url:	https://www.openssl.org/policies/secpolicy.html	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2015-3193	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2016-2182	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6302	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2017-3731	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2017-3737	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2016-6306	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2017-3738	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2016-6306	Trust: 0.3
url:	https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.29/	Trust: 0.3
url:	https://access.redhat.com/security/updates/classification/#moderate	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2016-2182	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2016-7055	Trust: 0.3
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3737	Trust: 0.3
url:	https://access.redhat.com/security/cve/cve-2016-6302	Trust: 0.3
url:	https://issues.jboss.org/):	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2018-2940	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2018-2952	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2018-12539	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2016-0705	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2016-0705	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2018-2973	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2018-1656	Trust: 0.2
url:	https://access.redhat.com/security/updates/classification/#important	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2018-2940	Trust: 0.2
url:	https://access.redhat.com/security/cve/cve-2018-1517	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2018-1517	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2018-2952	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2018-1656	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2018-2973	Trust: 0.2
url:	https://nvd.nist.gov/vuln/detail/cve-2018-12539	Trust: 0.2
url:	https://cwe.mitre.org/data/definitions/200.html	Trust: 0.1
url:	https://tools.cisco.com/security/center/viewalert.x?alertid=52438	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://usn.ubuntu.com/3181-1/	Trust: 0.1
url:	https://www.openssl.org/news/secadv/20161110.txt	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3730	Trust: 0.1
url:	https://www.openssl.org/news/secadv/20170828.txt,	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3735	Trust: 0.1
url:	https://www.openssl.org/news/secadv/20171102.txt	Trust: 0.1
url:	https://www.openssl.org/news/secadv/20180327.txt	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2016-0701	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0739	Trust: 0.1
url:	https://nvd.nist.gov/vuln/detail/cve-2018-0733	Trust: 0.1

CREDITS

The vulnerability is caused by OpenSSL Official website disclosure.

Trust: 0.6

sources: CNNVD: CNNVD-201702-216

SOURCES

db:	VULMON	id:	CVE-2017-3732
db:	JVNDB	id:	JVNDB-2017-003156
db:	PACKETSTORM	id:	169650
db:	PACKETSTORM	id:	169631
db:	PACKETSTORM	id:	169626
db:	PACKETSTORM	id:	148521
db:	PACKETSTORM	id:	148525
db:	PACKETSTORM	id:	148524
db:	PACKETSTORM	id:	149110
db:	PACKETSTORM	id:	149130
db:	CNNVD	id:	CNNVD-201702-216
db:	NVD	id:	CVE-2017-3732

LAST UPDATE DATE

2025-02-22T22:48:16.356000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2017-3732	date:	2022-08-29T00:00:00
db:	JVNDB	id:	JVNDB-2017-003156	date:	2018-02-07T00:00:00
db:	CNNVD	id:	CNNVD-201702-216	date:	2022-08-30T00:00:00
db:	NVD	id:	CVE-2017-3732	date:	2024-11-21T03:26:01.593

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2017-3732	date:	2017-05-04T00:00:00
db:	JVNDB	id:	JVNDB-2017-003156	date:	2017-05-18T00:00:00
db:	PACKETSTORM	id:	169650	date:	2017-01-26T12:12:12
db:	PACKETSTORM	id:	169631	date:	2017-11-02T12:12:12
db:	PACKETSTORM	id:	169626	date:	2018-03-27T12:12:12
db:	PACKETSTORM	id:	148521	date:	2018-07-12T21:45:18
db:	PACKETSTORM	id:	148525	date:	2018-07-12T21:48:57
db:	PACKETSTORM	id:	148524	date:	2018-07-12T21:48:49
db:	PACKETSTORM	id:	149110	date:	2018-08-28T16:46:26
db:	PACKETSTORM	id:	149130	date:	2018-08-29T00:28:49
db:	CNNVD	id:	CNNVD-201702-216	date:	2017-01-26T00:00:00
db:	NVD	id:	CVE-2017-3732	date:	2017-05-04T19:29:00.400