CVE-2018-0732

01/תיאור (מקור, אנגלית)

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

02/מוצרים מושפעים

openssl: openssl; canonical: ubuntu linux; debian: debian linux; nodejs: node.js

03/קישורים10

• nodejs.org/en/blog/vulnerability/august-2018-security-releases/ Vendor Advisory
• www.openssl.org/news/secadv/20180612.txt Vendor Advisory
• nodejs.org/en/blog/vulnerability/august-2018-security-releases/ Vendor Advisory
• www.openssl.org/news/secadv/20180612.txt Vendor Advisory
• www.oracle.com/technetwork/security-advisory/cpuoct2018-442829‮… PatchThird Party Advisory
• www.oracle.com/technetwork/security-advisory/cpuapr2019-507281‮… PatchThird Party Advisory
• www.oracle.com/technetwork/security-advisory/cpujan2019-507280‮… PatchThird Party Advisory
• www.oracle.com/technetwork/security-advisory/cpujul2019-507283‮… PatchThird Party Advisory
• www.oracle.com/technetwork/security-advisory/cpuoct2019-507283‮… PatchThird Party Advisory
• www.oracle.com/technetwork/security-advisory/cpuoct2018-442829‮… PatchThird Party Advisory