Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMF9BC443C8A73A169776E2C52F6AE8DF730B206D865193F14D59F7BE18252EDFB
HistorySep 14, 2018 - 6:40 p.m.

Security Bulletin: Aspera HSTS, HSTE and Desktop Client application is affected by openSSL vulnerabilities (CVE-2017-3738)

2018-09-1418:40:01
www.ibm.com
9

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

JSON

Summary

Aspera High-Speed Transfer Server (formerly known as Enterprise Server and Connect Server), High-Speed Transfer Endpoint (formerly known as Point-to-Point Client) and Desktop Client application have addressed the following openSSL vulnerabilities.

Vulnerability Details

CVEID: CVE-2017-3738 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. An attacker could exploit this vulnerability to obtain information about the private key. Note: In order to exploit this vulnerability, the server would have to share the DH1024 private key among multiple clients, which is no longer an option since CVE-2016-0701.
CVSS Base Score: 3.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/136078 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Products Affected Versions
Aspera High-Speed Transfer Server 3.8.0 and earlier
Aspera High-Speed Transfer Endpoint 3.8.0 and earlier
Aspera Desktop Client 3.8.0 and earlier 
 

Remediation/Fixes

Product VRMF APAR Remediation / First Fix
Aspera High-Speed Transfer Server 3.8.1 N/A https://downloads.asperasoft.com/en/downloads/1
Aspera High-Speed Transfer Endpoint 3.8.1 N/A https://downloads.asperasoft.com/en/downloads/7
Aspera Desktop Client 3.8.1 N/A https://downloads.asperasoft.com/en/downloads/2 
 

Workarounds and Mitigations

None.

CPENameOperatorVersion
ibm asperaeq3.8.0

Related

ibm 52
archlinux 5
freebsd 5
nessus 40
freebsd_advisory 1
openvas 28
osv 3
openssl 3
f5 4
cve 3
veracode 2
hackerone 1
intothesymmetry 3
redhatcve 2
prion 3
ubuntucve 3
debiancve 3
fortinet 1
ubuntu 2
alpinelinux 1
suse 2
amazon 2
mageia 2
cisco 1
altlinux 10
nodejsblog 1
openwrt 2
thn 1
fedora 1
cert 1
slackware 1
photon 2
debian 3
symantec 2
redhat 1
oraclelinux 2
ibm
ibm
Security Bulletin: Aspera OnDemand is affected by openSSL vulnerabilities (CVE-2017-3738)
2018-09-14 18:45:01
Security Bulletin: Security vulnerabilities in IBM SDK for Node.js might affect IBM Business Process Manager (BPM) Configuration Editor (CVE-2017-3737 CVE-2017-3738)
2022-09-15 19:23:37
Security Bulletin: Vulnerabilities in OpenSSL affect IBM® SDK for Node.js™ (CVE-2017-3737 CVE-2017-3738)
2018-08-09 04:20:36
archlinux
archlinux
[ASA-201804-6] lib32-openssl: private key recovery
2018-04-15 00:00:00
[ASA-201804-2] openssl: multiple issues
2018-04-01 00:00:00
[ASA-201712-11] lib32-openssl-1.0: multiple issues
2017-12-17 00:00:00
freebsd
freebsd
OpenSSL -- multiple vulnerabilities
2017-12-07 00:00:00
FreeBSD -- OpenSSL multiple vulnerabilities
2017-12-09 00:00:00
OpenSSL -- BN_mod_exp incorrect results on MIPS
2022-01-28 00:00:00
nessus
nessus
FreeBSD : OpenSSL -- multiple vulnerabilities (3bb451fc-db64-11e7-ac58-b499baebfeaf)
2017-12-08 00:00:00
FreeBSD : FreeBSD -- OpenSSL multiple vulnerabilities (9f7a0f39-ddc0-11e7-b5af-a4badb2f4699)
2017-12-11 00:00:00
EulerOS 2.0 SP2 : openssl (EulerOS-SA-2018-1115)
2018-05-02 00:00:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-17:12.openssl
2017-12-09 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2018-1179)
2020-01-23 00:00:00
Huawei EulerOS: Security Advisory for openssl (EulerOS-SA-2018-1115)
2020-01-23 00:00:00
OpenSSL 'Diffie-Hellman small subgroups' MitM Attack Vulnerability - Linux
2016-02-01 00:00:00
osv
osv
CVE-2017-3738
2017-12-07 16:29:00
CVE-2021-4160
2022-01-28 22:15:15
openssl1.0 - security update
2017-12-17 00:00:00
openssl
openssl
Vulnerability in OpenSSL CVE-2017-3738
2017-12-07 00:00:00
Vulnerability in OpenSSL CVE-2016-0701
2016-01-28 00:00:00
Vulnerability in OpenSSL CVE-2021-4160
2022-01-28 00:00:00
f5
f5
K34681653 : OpenSSL vulnerability CVE-2017-3738
2018-01-26 00:00:00
SOL64009378 - OpenSSL vulnerability CVE-2016-0701
2016-01-28 00:00:00
K64009378 : OpenSSL vulnerability CVE-2016-0701
2016-01-29 00:00:00
cve
cve
CVE-2017-3738
2017-12-07 16:29:00
CVE-2016-0701
2016-02-15 02:59:00
CVE-2021-4160
2022-01-28 22:15:00
veracode
veracode
Unsafe Number Generation
2017-02-06 03:20:38
Overflow In Multiplication Procedure
2018-04-02 04:57:20
hackerone
hackerone
Internet Bug Bounty: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
2016-01-28 16:56:21
intothesymmetry
intothesymmetry
The RFC 5114 saga
2016-10-20 12:16:00
The Curious Case of WebCrypto Diffie-Hellman on Firefox - Small Subgroups Key Recovery Attack on DH
2020-01-07 15:08:00
OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
2016-01-29 05:19:00
redhatcve
redhatcve
CVE-2017-3738
2019-10-08 22:39:45
CVE-2021-4160
2022-01-31 17:57:31
prion
prion
Buffer overflow
2017-12-07 16:29:00
Design/Logic Flaw
2016-02-15 02:59:00
Design/Logic Flaw
2022-01-28 22:15:00
ubuntucve
ubuntucve
CVE-2016-0701
2016-01-28 00:00:00
CVE-2017-3738
2017-12-07 00:00:00
CVE-2021-4160
2022-01-28 00:00:00
debiancve
debiancve
CVE-2016-0701
2016-02-15 02:59:00
CVE-2017-3738
2017-12-07 16:29:00
CVE-2021-4160
2022-01-28 22:15:00
fortinet
fortinet
OpenSSL Advisory - January 2016
2016-07-12 00:00:00
ubuntu
ubuntu
OpenSSL vulnerability
2016-01-28 00:00:00
OpenSSL vulnerabilities
2017-12-11 00:00:00
alpinelinux
alpinelinux
CVE-2017-3738
2017-12-07 16:29:00
suse
suse
Security update for openssl (important)
2017-12-16 06:08:45
Security update for openssl (important)
2017-12-16 15:07:17
amazon
amazon
Medium: openssl
2018-05-10 17:29:00
Medium: openssl
2018-04-26 17:38:00
mageia
mageia
Updated openssl packages fix security vulnerabilities
2017-12-17 02:20:04
Updated openssl packages fix security vulnerabilities
2016-02-09 16:05:25
cisco
cisco
Multiple Vulnerabilities in OpenSSL (January 2016) Affecting Cisco Products
2016-01-29 16:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package openssl10 version 1.0.2f-alt1
2016-01-28 00:00:00
Security fix for the ALT Linux 7 package openssl10 version 1.0.1r-alt0.M70P.1
2016-01-28 00:00:00
Security fix for the ALT Linux 8 package openssl10 version 1.0.2f-alt1
2016-01-28 00:00:00
nodejsblog
nodejsblog
OpenSSL upgrade low-severity Node.js security fixes
2016-01-27 00:00:00
openwrt
openwrt
openssl: Security update (2 CVEs)
2016-01-28 20:32:02
openssl: Security update (2 CVEs)
2016-01-29 15:48:20
thn
thn
Critical OpenSSL Flaw Allows Hackers to Decrypt HTTPS Traffic
2016-01-28 22:01:00
fedora
fedora
[SECURITY] Fedora 23 Update: openssl-1.0.2f-1.fc23
2016-01-30 18:23:36
cert
cert
OpenSSL re-uses unsafe prime numbers in Diffie-Hellman protocol
2016-01-28 00:00:00
slackware
slackware
[slackware-security] openssl
2017-12-09 03:52:34
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-0010-A
2018-01-06 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-1.0-0097-A
2018-01-06 00:00:00
debian
debian
[SECURITY] [DSA 4157-1] openssl security update
2018-03-29 20:57:40
[SECURITY] [DSA 4157-1] openssl security update
2018-03-29 20:57:40
[SECURITY] [DSA 4065-1] openssl1.0 security update
2017-12-17 13:59:51
symantec
symantec
SA159: OpenSSL Vulnerabilities 7-Dec-2017
2018-01-16 08:00:00
SA111 : OpenSSL Vulnerabilities 28-Jan-2016
2016-02-18 08:00:00
redhat
redhat
(RHSA-2018:0998) Moderate: openssl security and bug fix update
2018-04-10 05:05:23
oraclelinux
oraclelinux
openssl security and bug fix update
2018-04-16 00:00:00
openssl security update
2018-04-18 00:00:00

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

JSON
Related for F9BC443C8A73A169776E2C52F6AE8DF730B206D865193F14D59F7BE18252EDFB
ibm52archlinux5freebsd5nessus40freebsd_advisory1openvas28osv3openssl3f54cve3veracode2hackerone1intothesymmetry3redhatcve2prion3ubuntucve3debiancve3fortinet1ubuntu2alpinelinux1suse2amazon2mageia2cisco1altlinux10nodejsblog1openwrt2thn1fedora1cert1slackware1photon2debian3symantec2redhat1oraclelinux2