CVE-2017-3731
Published May 4, 2017
Last updated 2 years ago
Overview
- Description
- If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
- Source
- openssl-security@openssl.org
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
- nvd@nist.gov
- CWE-125
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9D7A18A-116B-4F68-BEA3-A4E9DDDA55C6"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFC70262-0DCD-4B46-9C96-FD18D0207511"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B2E07A34-08A0-4765-AF81-46A3BDC5648A"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD3E5C1B-EC63-4214-A0BD-0B8681CE6C8B"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "18797BEE-417D-4959-9AAD-C5A7C051B524"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6FAA3C31-BD9D-45A9-A502-837FECA6D479"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6455A421-9956-4846-AC7C-3431E0D37D23"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "60F946FD-F564-49DA-B043-5943308BA9EE"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4847BCF3-EFCE-41AF-8E7D-3D51EB9DCC5B"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9B89180B-FB68-4DD8-B076-16E51CC7FB91"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4C986592-4086-4A39-9767-EF34DBAA6A53"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B23181C-03DB-4E92-B3F6-6B585B5231B4"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94D9EC1C-4843-4026-9B05-E060E9391734"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "036FB24F-7D86-4730-8BC9-722875BEC807"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FDF148A3-1AA7-4F27-85AB-414C609C626F"
},
{
"criteria": "cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E15B749E-6808-4788-AE42-7A1587D8697E"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A47FC4F7-1F77-4314-B4B3-3C5D8E335379",
"versionEndIncluding": "4.1.2",
"versionStartIncluding": "4.0.0"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "934083EB-2961-49FF-B8D7-B870D1FA3CB8",
"versionEndExcluding": "4.7.3",
"versionStartIncluding": "4.2.0"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "121E5D5D-B4D9-43F3-B5C9-74590192FAF1",
"versionEndIncluding": "5.12.0",
"versionStartIncluding": "5.0.0"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D107EC29-67E7-40C3-8E5A-324C9105C5E4",
"versionEndIncluding": "6.8.1",
"versionStartIncluding": "6.0.0"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14346EBC-1890-472B-B236-06FE381229EC",
"versionEndExcluding": "6.9.5",
"versionStartIncluding": "6.9.0"
},
{
"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2EE58CC5-2E12-4DA9-8AF2-9739CE393008",
"versionEndExcluding": "7.5.0",
"versionStartIncluding": "7.0.0"
}
],
"operator": "OR"
}
]
}
]