CVE-2018-0733 Incorrect CRYPTO_memcmp on HP-UX PA-RISC
An implementation bug in OpenSSL on HP-UX PA-RISC weakens constant-time comparison, allowing attackers to forge authenticated messages with fewer attempts than expected.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-0733?
CVE-2018-0733 is a medium-severity vulnerability in Openssl Openssl, published on 27 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).
Which versions are affected by CVE-2018-0733?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2018-0733?
Upgrade to a fixed version.
Is CVE-2018-0733 being exploited?
There is no known exploitation of CVE-2018-0733 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as ALPINE-CVE-2018-0733, DEBIAN-CVE-2018-0733, GHSA-j66x-3v7r-hj5f.