If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.

OSVersionArchitecturePackageVersionFilename
Debian12allopenssl< 1.1.0d-1openssl_1.1.0d-1_all.deb
Debian11allopenssl< 1.1.0d-1openssl_1.1.0d-1_all.deb
Debian10allopenssl< 1.1.0d-1openssl_1.1.0d-1_all.deb
Debian999allopenssl< 1.1.0d-1openssl_1.1.0d-1_all.deb
Debian13allopenssl< 1.1.0d-1openssl_1.1.0d-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	openssl	< 1.1.0d-1	openssl_1.1.0d-1_all.deb
Debian	11	all	openssl	< 1.1.0d-1	openssl_1.1.0d-1_all.deb
Debian	10	all	openssl	< 1.1.0d-1	openssl_1.1.0d-1_all.deb
Debian	999	all	openssl	< 1.1.0d-1	openssl_1.1.0d-1_all.deb
Debian	13	all	openssl	< 1.1.0d-1	openssl_1.1.0d-1_all.deb

checkpoint_advisories 1

ibm 49

openvas 19

prion 1

nessus 52

osv 3

alpinelinux 1

aix 1

ubuntucve 1

veracode 2

cve 1

openssl 1

f5 1

paloalto 1

oraclelinux 5

centos 1

amazon 1

redhat 4

altlinux 5

fedora 2

freebsd_advisory 1

slackware 1

symantec 1

huawei 1

mageia 2

myhack58 1

debian 2

archlinux 2

nodejsblog 1

freebsd 1

fortinet 1

cisco 1

gentoo 1

suse 5

ubuntu 1

cloudfoundry 1

packetstorm 1

androidsecurity 1

oracle 5

checkpoint_advisories

OpenSSL ChaCha20-Poly1305 and RC4-MD5 Integer Underflow (CVE-2017-3731)

2017-02-27 00:00:00

ibm

Security Bulletin: IBM WebSphere Cast Iron Solution is affected by an OpenSSL vulnerability (CVE-2017-3731)

2019-11-18 13:57:34

Security Bulletin: Vulnerability in OpenSSL affects IBM Sterling Connect:Direct for UNIX (CVE-2017-3731)

2020-07-24 22:19:08

Security Bulletin: Vulnerability in OpenSSL affects IBM Sterling Connect:Direct for Microsoft Windows (CVE-2017-3731)

2020-07-24 22:19:08

openvas

Oracle Mysql Security Updates (oct2017-3236626) 03 - Windows

2017-10-18 00:00:00

Palo Alto PAN-OS OpenSSL Vulnerability

2017-05-23 00:00:00

Oracle Mysql Security Updates (oct2017-3236626) 03 - Linux

2017-10-18 00:00:00

prion

Out-of-bounds

2017-05-04 19:29:00

nessus

AIX OpenSSL Advisory : openssl_advisory23.asc

2018-03-08 00:00:00

F5 Networks BIG-IP : OpenSSL vulnerability (K37526132)

2017-02-24 00:00:00

Virtuozzo 6 : openssl / openssl-devel / openssl-perl / etc (VZLSA-2017-0286)

2017-07-13 00:00:00

osv

CVE-2017-3731

2017-05-04 19:29:00

openssl - security update

2017-02-01 00:00:00

openssl - security update

2017-01-27 00:00:00

alpinelinux

CVE-2017-3731

2017-05-04 19:29:00

aix

There is a vulnerability in OpenSSL used by AIX

2017-02-17 16:58:26

ubuntucve

CVE-2017-3731

2017-01-26 00:00:00

veracode

Denial Of Service (DoS) Through Out Of Bounds Read

2017-03-17 08:05:26

Vulnerability Through C Libraries

2017-11-01 05:30:33

cve

CVE-2017-3731

2017-05-04 19:29:00

openssl

Vulnerability in OpenSSL CVE-2017-3731

2017-01-26 00:00:00

K37526132 : OpenSSL vulnerability CVE-2017-3731

2017-02-23 00:00:00

paloalto

OpenSSL Vulnerability

2017-04-20 18:00:00

oraclelinux

openssl security update

2017-02-20 00:00:00

openssl security update

2017-02-20 00:00:00

openssl security update

2017-02-20 00:00:00

centos

openssl security update

2017-02-21 11:44:42

amazon

Medium: openssl

2017-03-06 14:00:00

redhat

(RHSA-2017:0286) Moderate: openssl security update

2017-02-20 09:06:19

(RHSA-2018:2187) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 security update

2018-07-12 16:04:13

(RHSA-2018:2186) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 security update

2018-07-12 16:04:10

altlinux

Security fix for the ALT Linux 9 package openssl10 version 1.0.2k-alt1

2017-01-26 00:00:00

Security fix for the ALT Linux 10 package openssl1.1 version 1.0.2k-alt1

2017-01-26 00:00:00

Security fix for the ALT Linux 8 package openssl10 version 1.0.2k-alt0.M80P.1

2017-01-27 00:00:00

fedora

[SECURITY] Fedora 24 Update: openssl-1.0.2k-1.fc24

2017-02-09 20:52:22

[SECURITY] Fedora 25 Update: openssl-1.0.2k-1.fc25

2017-02-08 01:54:49

freebsd_advisory

FreeBSD-SA-17:02.openssl

2017-02-23 00:00:00

slackware

[slackware-security] openssl

2017-02-10 20:40:56

symantec

SA141 : OpenSSL Vulnerabilities 26-Jan-2017

2017-02-09 08:00:00

huawei

Security Advisory - Three OpenSSL Vulnerabilities in Huawei Products

2017-05-03 00:00:00

mageia

Updated openssl packages fix security vulnerability

2017-02-05 23:42:41

Updated virtualbox packages fix security vulnerabilities

2017-10-27 10:16:04

myhack58

OpenSSL handshake renegotiation process in the presence of the vulnerability can lead to denial of service-vulnerability warning-the black bar safety net

2017-05-22 00:00:00

debian

[SECURITY] [DSA 3773-1] openssl security update

2017-01-27 19:48:57

[SECURITY] [DLA 814-1] openssl security update

2017-02-01 23:12:31

archlinux

[ASA-201701-36] lib32-openssl: multiple issues

2017-01-27 00:00:00

[ASA-201701-37] openssl: multiple issues

2017-01-28 00:00:00

nodejsblog

OpenSSL update, 1.0.2k

2017-01-27 00:00:00

freebsd

OpenSSL -- multiple vulnerabilities

2017-01-26 00:00:00

fortinet

OpenSSL Security Advisory [26 Jan 2017]

2018-07-13 00:00:00

cisco

Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: January and February 2017

2017-01-30 21:28:00

gentoo

OpenSSL: Multiple vulnerabilities

2017-02-14 00:00:00

suse

Security update for openssl (important)

2018-01-16 18:08:42

Security update for mysql-community-server (important)

2017-10-27 18:28:48

Security update for openssl-steam (important)

2018-02-16 12:07:45

ubuntu

OpenSSL vulnerabilities

2017-01-31 00:00:00

cloudfoundry

USN-3181-1: OpenSSL vulnerabilities | Cloud Foundry

2017-06-02 00:00:00

packetstorm

Orion Elite Hidden IP Browser Pro 7.9 OpenSSL / Tor / Man-In-The-Middle

2017-07-14 00:00:00

androidsecurity

Pixel&hairsp;/&hairsp;Nexus Security Bulletin—November 2017

2017-11-06 00:00:00

oracle

Oracle Critical Patch Update - January 2018

2018-01-16 00:00:00

Oracle Critical Patch Update Advisory - April 2019

2019-04-16 00:00:00

Oracle Critical Patch Update - October 2017

2017-10-17 00:00:00

Products

Security Intelligence
Non-intrusive assessment
Developers SDK
Windows scanner
Linux scanner
Perimeter control tool
MSSP

Database

Vulnerabilities
Exploits
IOC
Security News
BugBounty
Popular
Wild Exploited
Top Vulnerabilities

Tools

Linux Security Scanner
API integration
Subscriptions
Plugins
Manual Audit

Learn More

Stats
API
Docs
Api-keys
License
Pricing
Glossary
FAQ

Company

Blog
Contacts
About Us
OpenSource
EULA
Brand Guideline
Privacy Policy

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please contact us. Using Vulners services you are accepting Vulners services end-user license agreement

@2024 Vulners Inc

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.046 Low

EPSS

Percentile

92.4%

JSON

Related for DEBIANCVE:CVE-2017-3731