CVE-2017-3735 Information disclosure in OpenSSL
A one-byte overread in OpenSSL's X.509 certificate parsing allows attackers to read adjacent memory, potentially disclosing sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-3735?
CVE-2017-3735 is a medium-severity vulnerability in Debian Debian Linux, published on 28 Aug 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.
Weakness: CWE-119
Which versions are affected by CVE-2017-3735?
It affects 2 products.
Linux distribution packages (4)
openssl1 SUSE:Linux Enterprise Server 11-SECURITY | All versions | 1.0.1g-0.58.3.1 |
openssl SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 1.0.1i-54.8.1 |
openssl SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 1.0.1i-54.8.1 |
openssl SUSE:OpenStack Cloud 6 | All versions | 1.0.1i-54.8.1 |
Products include Debian Debian Linux, Openssl Openssl.
How do I fix CVE-2017-3735?
Upgrade to a fixed version.
Is CVE-2017-3735 being exploited?
There is no known exploitation of CVE-2017-3735 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2017-3735, DEBIAN-CVE-2017-3735, DLA-1157-1, DSA-4018-1, GHSA-6h3q-hmhp-4vgv, SUSE-SU-2017:2968-1 and 2 more.