Yüksek CVSS 7.5

CVE-2018-0732: Openssl: güvenlik açığı

Yayın: 12 Haziran 2018 16:29 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Özet bilgiler

Ürün: Openssl Openssl
CVSS v3.1: 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: %47,01 (yüzdelik 99)
CWE: CWE-320
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
openssl-openssl	1.0.2	1.0.2o	—
openssl-openssl	1.1.0	1.1.0h	—
canonical-ubuntu-linux	12.04	12.04	—
canonical-ubuntu-linux	14.04	14.04	—
canonical-ubuntu-linux	16.04	16.04	—
canonical-ubuntu-linux	17.10	17.10	—
canonical-ubuntu-linux	18.04	18.04	—
debian-debian-linux	8.0	8.0	—
nodejs-node.js	6.0.0	—	6.8.1
nodejs-node.js	6.9.0	—	6.14.4
nodejs-node.js	8.0.0	—	8.8.1
nodejs-node.js	8.9.0	—	8.11.4
nodejs-node.js	10.0.0	—	10.9.0

Kaynaklar

Uygulamada aç Tüm CVE kayıtları