CVE-2017-3730
Published May 4, 2017
Last updated 6 years ago
Overview
- Description
- In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
- Source
- openssl-security@openssl.org
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
- nvd@nist.gov
- CWE-476
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "73104834-5810-48DD-9B97-549D223853F1"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9D7A18A-116B-4F68-BEA3-A4E9DDDA55C6"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFC70262-0DCD-4B46-9C96-FD18D0207511"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2E07A34-08A0-4765-AF81-46A3BDC5648A"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:agile_engineering_data_management:6.1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "61C5D278-11E5-4A2F-9860-6FFA579398CD"
},
{
"criteria": "cpe:2.3:a:oracle:agile_engineering_data_management:6.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1B21D189-0E7D-4878-91A0-BE38A4ABA1FD"
},
{
"criteria": "cpe:2.3:a:oracle:communications_application_session_controller:3.7.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CC967A48-D834-4E9B-8CEC-057E7D5B8174"
},
{
"criteria": "cpe:2.3:a:oracle:communications_application_session_controller:3.8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F920CDE4-DF29-4611-93E9-A386C89EDB62"
},
{
"criteria": "cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D195BC4C-DAC2-4C71-B83B-4149E86B5F42"
},
{
"criteria": "cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:10.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "996861FC-0089-4BED-8E46-F2B76037EA65"
},
{
"criteria": "cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:10.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37764AF5-E42E-461E-AA43-763D21B3DCE2"
},
{
"criteria": "cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D52F557F-D0A0-43D3-85F1-F10B6EBFAEDF"
},
{
"criteria": "cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3517A27-E6EE-497C-9996-F78171BBE90F"
},
{
"criteria": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "41684398-18A4-4DC6-B8A2-3EBAA0CBF9A6"
},
{
"criteria": "cpe:2.3:a:oracle:jd_edwards_world_security:a9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2ECA28E-E810-4D35-9151-FDBBBE069A81"
},
{
"criteria": "cpe:2.3:a:oracle:jd_edwards_world_security:a9.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA144657-7598-46E2-AB0A-FD332EDECEC3"
},
{
"criteria": "cpe:2.3:a:oracle:jd_edwards_world_security:a9.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83800E2F-804C-485D-A8FA-F4B32CDB4548"
},
{
"criteria": "cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0B1CAD50-749F-4ADB-A046-BF3585677A58"
}
],
"operator": "OR"
}
]
}
]