The vulnerability of the Encrypt-Then-Mac extension in the OpenSSL library, which allows a hacker to trigger a denial-of-service attack

🗓️ 22 Jun 2020 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

The OpenSSL Encrypt-Then-Mac extension has insufficient input validation, enabling remote denial of service.

Reporter	Title	Published	Views	Family All 44
IBM Security Bulletins	Security Bulletin: Open Source OpenSSL Vulnerabilities in IBM Network Advisor	18 Jun 201800:34	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affects IBM Tivoli Composite Application Manager for Transactions	17 Jun 201815:39	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service vulnerability in OpenSSL affects IBM InfoSphere Master Data Management (CVE-2017-3733)	16 Jun 201813:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Rational Application Developer for WebSphere Software	5 Feb 202000:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in OpenSSL affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru Firmware, QLogic 8Gb Intelligent Pass-thru Module & SAN Switch Module and QLogic Virtual Fabric Extension Module for IBM BladeCenter systems	14 Apr 202314:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i and Rational Developer for AIX and Linux	3 Aug 201804:23	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in OpenSSL affect IBM Spectrum Protect (formerly Tivoli Storage Manager) Client and IBM Spectrum Protect (formerly Tivoli Storage Manager) for Virtual Environments: Data Protection for VMware	17 Jun 201815:40	–	ibm
FreeBSD	openssl -- crash on handshake	16 Feb 201700:00	–	freebsd
Tenable Nessus	OpenSSL 1.1.0 < 1.1.0e DoS	22 Feb 201700:00	–	nessus
Tenable Nessus	FreeBSD : openssl -- crash on handshake (1a802ba9-f444-11e6-9940-b499baebfeaf)	17 Feb 201700:00	–	nessus

Vulners

Node

openssl opensslRange<1.1.0e

OR

novell opensuse_leapMatch15.0

Source	Link
suse	www.suse.com/security/cve/CVE-2017-3733/
openssl	www.openssl.org/news/secadv/20170216.txt
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-3733
security-tracker	www.security-tracker.debian.org/tracker/CVE-2017-3733
web	www.web.nvd.nist.gov/view/vuln/detail

22 Jun 2020 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 37.5

CVSS 27.8

EPSS0.12874

OpenSSL Encrypt-Then-Mac input validation denial of service remote attacker vulnerability