OpenSSL CVE-2017-3738 Information Disclosure Vulnerability

Bugtraq ID:	102118
Class:	Design Error
CVE:	CVE-2017-3738
Remote:	Yes
Local:	No
Published:	Dec 07 2017 12:00AM
Updated:	Oct 15 2018 09:00AM
Credit:	David Benjamin
Vulnerable:	Oracle Linux 7.0 OpenSSL Project OpenSSL 1.1 OpenSSL Project OpenSSL 1.0.2 OpenSSL Project OpenSSL 1.1.0g OpenSSL Project OpenSSL 1.1.0f-git OpenSSL Project OpenSSL 1.1.0f OpenSSL Project OpenSSL 1.1.0e OpenSSL Project OpenSSL 1.1.0d OpenSSL Project OpenSSL 1.1.0c OpenSSL Project OpenSSL 1.1.0b OpenSSL Project OpenSSL 1.1.0a OpenSSL Project OpenSSL 1.0.2m OpenSSL Project OpenSSL 1.0.2l OpenSSL Project OpenSSL 1.0.2k OpenSSL Project OpenSSL 1.0.2j OpenSSL Project OpenSSL 1.0.2i OpenSSL Project OpenSSL 1.0.2h OpenSSL Project OpenSSL 1.0.2g OpenSSL Project OpenSSL 1.0.2f OpenSSL Project OpenSSL 1.0.2e OpenSSL Project OpenSSL 1.0.2d OpenSSL Project OpenSSL 1.0.2c OpenSSL Project OpenSSL 1.0.2b OpenSSL Project OpenSSL 1.0.2a IBM DB2 9.8 IBM DB2 9.7 IBM DB2 11.1 IBM DB2 10.5 IBM DB2 10.1
Not Vulnerable:	OpenSSL Project OpenSSL 1.1.0h OpenSSL Project OpenSSL 1.0.2n

OpenSSL CVE-2017-3738 Information Disclosure Vulnerability

OpenSSL is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

OpenSSL versions 1.0.2 through 1.0.2m are vulnerable.

OpenSSL CVE-2017-3738 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenSSL CVE-2017-3738 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OpenSSL CVE-2017-3738 Information Disclosure Vulnerability

References:

• OpenSSL Homepage (OpenSSL)
  
• OpenSSL Security Advisory [27 Mar 2018] (OpenSSL )
  
• Oracle Linux Bulletin - April 2018 (Oracle)
  
• Published Security Vulnerabilities for DB2 for Linux, UNIX, and Windows includin (IBM)
  
• rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738) (openssl)