5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
OpenSSL is vulnerable to information disclosure. The library contains a carry propagation bug during the montgomery squaring procedure. This makes it easier for a malicious user to obtain sensitive private key information from the Diffie-Hellman Ciphersuite as the attack can be conducted offline.
www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
www.securityfocus.com/bid/95814
www.securitytracker.com/id/1037717
access.redhat.com/errata/RHSA-2018:2185
access.redhat.com/errata/RHSA-2018:2186
access.redhat.com/errata/RHSA-2018:2187
access.redhat.com/errata/RHSA-2018:2568
access.redhat.com/errata/RHSA-2018:2575
access.redhat.com/errata/RHSA-2018:2713
github.com/openssl/openssl/commit/a59b90bf491410f1f2bc4540cc21f1980fd14c5b
security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc
security.gentoo.org/glsa/201702-07
support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us
www.openssl.org/news/secadv/20170126.txt
www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
www.sourceclear.com/registry/security/information-disclosure/objective-c/sid-3552
www.tenable.com/security/tns-2017-04
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N