Read the docs
TI-2017-02851 Aliases CVE-2017-3735GHSA-6h3q-hmhp-4vgv

Memory corruption in OpenSSL

Priority MEDIUM 43CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 10 fixed, 10 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.

Why it matters now

EPSS 0.20968 97th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 10 fixed, 10 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSSLOpenSSL1.1.0; 1.0.2—No fix listedCNA
  • OpenSSL VendorOpenSSL Affected 1.1.0; 1.0.2 Fixed in — No fix listed CNA

CPE configurations NVD · 102

CPEVersionsRoleVendor
cpe:2.3:a:openssl:openssl:0.9.7j:*:*:*:*:*:*:*0.9.7jVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.7k:*:*:*:*:*:*:*0.9.7kVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.7l:*:*:*:*:*:*:*0.9.7lVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.7m:*:*:*:*:*:*:*0.9.7mVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:*0.9.8VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:*0.9.8aVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:*0.9.8bVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8c:*:*:*:*:*:*:*0.9.8cVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8d:*:*:*:*:*:*:*0.9.8dVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8e:*:*:*:*:*:*:*0.9.8eVulnerableOpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.7j:*:*:*:*:*:*:* Versions 0.9.7j Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.7k:*:*:*:*:*:*:* Versions 0.9.7k Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.7l:*:*:*:*:*:*:* Versions 0.9.7l Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.7m:*:*:*:*:*:*:* Versions 0.9.7m Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8:*:*:*:*:*:*:* Versions 0.9.8 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8a:*:*:*:*:*:*:* Versions 0.9.8a Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8b:*:*:*:*:*:*:* Versions 0.9.8b Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8c:*:*:*:*:*:*:* Versions 0.9.8c Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8d:*:*:*:*:*:*:* Versions 0.9.8d Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8e:*:*:*:*:*:*:* Versions 0.9.8e Vulnerable ·OpenSSL
Show 92 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openssl:openssl:0.9.8f:*:*:*:*:*:*:*0.9.8fVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8g:*:*:*:*:*:*:*0.9.8gVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8h:*:*:*:*:*:*:*0.9.8hVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8i:*:*:*:*:*:*:*0.9.8iVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8j:*:*:*:*:*:*:*0.9.8jVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8k:*:*:*:*:*:*:*0.9.8kVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8l:*:*:*:*:*:*:*0.9.8lVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8m:*:*:*:*:*:*:*0.9.8mVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8m:beta1:*:*:*:*:*:*0.9.8m beta1VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8n:*:*:*:*:*:*:*0.9.8nVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8o:*:*:*:*:*:*:*0.9.8oVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8p:*:*:*:*:*:*:*0.9.8pVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8q:*:*:*:*:*:*:*0.9.8qVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8r:*:*:*:*:*:*:*0.9.8rVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8s:*:*:*:*:*:*:*0.9.8sVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8t:*:*:*:*:*:*:*0.9.8tVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8u:*:*:*:*:*:*:*0.9.8uVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8v:*:*:*:*:*:*:*0.9.8vVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8w:*:*:*:*:*:*:*0.9.8wVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8x:*:*:*:*:*:*:*0.9.8xVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8y:*:*:*:*:*:*:*0.9.8yVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8z:*:*:*:*:*:*:*0.9.8zVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8za:*:*:*:*:*:*:*0.9.8zaVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8zb:*:*:*:*:*:*:*0.9.8zbVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8zc:*:*:*:*:*:*:*0.9.8zcVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8ze:*:*:*:*:*:*:*0.9.8zeVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:0.9.8zg:*:*:*:*:*:*:*0.9.8zgVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:*1.0.0 beta1VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:*1.0.0 beta2VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:*1.0.0 beta3VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0:beta4:*:*:*:*:*:*1.0.0 beta4VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0:beta5:*:*:*:*:*:*1.0.0 beta5VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:*1.0.0aVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:*1.0.0bVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:*1.0.0cVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:*1.0.0dVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:*1.0.0eVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:*1.0.0fVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:*1.0.0gVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:*1.0.0hVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:*1.0.0iVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:*1.0.0jVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0k:*:*:*:*:*:*:*1.0.0kVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0l:*:*:*:*:*:*:*1.0.0lVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0m:*:*:*:*:*:*:*1.0.0mVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0n:*:*:*:*:*:*:*1.0.0nVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0o:*:*:*:*:*:*:*1.0.0oVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0p:*:*:*:*:*:*:*1.0.0pVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0q:*:*:*:*:*:*:*1.0.0qVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0r:*:*:*:*:*:*:*1.0.0rVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.0s:*:*:*:*:*:*:*1.0.0sVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:*1.0.1 beta1VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:*1.0.1 beta2VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:*1.0.1 beta3VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:*1.0.1aVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:*1.0.1bVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:*1.0.1cVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:*1.0.1dVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:*1.0.1eVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:*1.0.1fVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:*1.0.1gVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:*1.0.1hVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*1.0.1iVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:*1.0.1jVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:*1.0.1kVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:*1.0.1lVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*1.0.2 beta1VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*1.0.2 beta2VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*1.0.2 beta3VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:*1.0.2aVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:*1.0.2bVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:*1.0.2cVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:*1.0.2dVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:*1.0.2eVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:*1.0.2fVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:*1.0.2hVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:*1.0.2iVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:*1.0.2jVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:*1.0.2kVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:*1.0.2lVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:*1.1.0VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:*1.1.0aVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:*1.1.0bVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:*1.1.0cVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.1.0d:*:*:*:*:*:*:*1.1.0dVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.1.0e:*:*:*:*:*:*:*1.1.0eVulnerableOpenSSL
cpe:2.3:a:openssl:openssl:1.1.0f:*:*:*:*:*:*:*1.1.0fVulnerableOpenSSL
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:openssl:openssl:0.9.8f:*:*:*:*:*:*:* Versions 0.9.8f Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8g:*:*:*:*:*:*:* Versions 0.9.8g Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8h:*:*:*:*:*:*:* Versions 0.9.8h Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8i:*:*:*:*:*:*:* Versions 0.9.8i Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8j:*:*:*:*:*:*:* Versions 0.9.8j Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8k:*:*:*:*:*:*:* Versions 0.9.8k Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8l:*:*:*:*:*:*:* Versions 0.9.8l Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8m:*:*:*:*:*:*:* Versions 0.9.8m Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8m:beta1:*:*:*:*:*:* Versions 0.9.8m beta1 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8n:*:*:*:*:*:*:* Versions 0.9.8n Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8o:*:*:*:*:*:*:* Versions 0.9.8o Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8p:*:*:*:*:*:*:* Versions 0.9.8p Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8q:*:*:*:*:*:*:* Versions 0.9.8q Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8r:*:*:*:*:*:*:* Versions 0.9.8r Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8s:*:*:*:*:*:*:* Versions 0.9.8s Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8t:*:*:*:*:*:*:* Versions 0.9.8t Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8u:*:*:*:*:*:*:* Versions 0.9.8u Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8v:*:*:*:*:*:*:* Versions 0.9.8v Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8w:*:*:*:*:*:*:* Versions 0.9.8w Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8x:*:*:*:*:*:*:* Versions 0.9.8x Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8y:*:*:*:*:*:*:* Versions 0.9.8y Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8z:*:*:*:*:*:*:* Versions 0.9.8z Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8za:*:*:*:*:*:*:* Versions 0.9.8za Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8zb:*:*:*:*:*:*:* Versions 0.9.8zb Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8zc:*:*:*:*:*:*:* Versions 0.9.8zc Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8ze:*:*:*:*:*:*:* Versions 0.9.8ze Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:0.9.8zg:*:*:*:*:*:*:* Versions 0.9.8zg Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0:beta1:*:*:*:*:*:* Versions 1.0.0 beta1 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0:beta2:*:*:*:*:*:* Versions 1.0.0 beta2 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0:beta3:*:*:*:*:*:* Versions 1.0.0 beta3 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0:beta4:*:*:*:*:*:* Versions 1.0.0 beta4 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0:beta5:*:*:*:*:*:* Versions 1.0.0 beta5 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0a:*:*:*:*:*:*:* Versions 1.0.0a Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0b:*:*:*:*:*:*:* Versions 1.0.0b Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0c:*:*:*:*:*:*:* Versions 1.0.0c Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0d:*:*:*:*:*:*:* Versions 1.0.0d Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0e:*:*:*:*:*:*:* Versions 1.0.0e Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0f:*:*:*:*:*:*:* Versions 1.0.0f Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0g:*:*:*:*:*:*:* Versions 1.0.0g Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0h:*:*:*:*:*:*:* Versions 1.0.0h Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0i:*:*:*:*:*:*:* Versions 1.0.0i Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0j:*:*:*:*:*:*:* Versions 1.0.0j Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0k:*:*:*:*:*:*:* Versions 1.0.0k Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0l:*:*:*:*:*:*:* Versions 1.0.0l Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0m:*:*:*:*:*:*:* Versions 1.0.0m Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0n:*:*:*:*:*:*:* Versions 1.0.0n Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0o:*:*:*:*:*:*:* Versions 1.0.0o Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0p:*:*:*:*:*:*:* Versions 1.0.0p Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0q:*:*:*:*:*:*:* Versions 1.0.0q Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0r:*:*:*:*:*:*:* Versions 1.0.0r Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.0s:*:*:*:*:*:*:* Versions 1.0.0s Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1:beta1:*:*:*:*:*:* Versions 1.0.1 beta1 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1:beta2:*:*:*:*:*:* Versions 1.0.1 beta2 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1:beta3:*:*:*:*:*:* Versions 1.0.1 beta3 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:* Versions 1.0.1a Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:* Versions 1.0.1b Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:* Versions 1.0.1c Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:* Versions 1.0.1d Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:* Versions 1.0.1e Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:* Versions 1.0.1f Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:* Versions 1.0.1g Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:* Versions 1.0.1h Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:* Versions 1.0.1i Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:* Versions 1.0.1j Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:* Versions 1.0.1k Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:* Versions 1.0.1l Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:* Versions 1.0.2 beta1 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:* Versions 1.0.2 beta2 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:* Versions 1.0.2 beta3 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:* Versions 1.0.2a Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:* Versions 1.0.2b Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:* Versions 1.0.2c Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:* Versions 1.0.2d Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:* Versions 1.0.2e Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:* Versions 1.0.2f Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:* Versions 1.0.2h Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2i:*:*:*:*:*:*:* Versions 1.0.2i Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2j:*:*:*:*:*:*:* Versions 1.0.2j Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2k:*:*:*:*:*:*:* Versions 1.0.2k Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.0.2l:*:*:*:*:*:*:* Versions 1.0.2l Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:* Versions 1.1.0a Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:* Versions 1.1.0b Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:* Versions 1.1.0c Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.1.0d:*:*:*:*:*:*:* Versions 1.1.0d Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.1.0e:*:*:*:*:*:*:* Versions 1.1.0e Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:1.1.0f:*:*:*:*:*:*:* Versions 1.1.0f Vulnerable ·OpenSSL
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

Red Hat 1 advisory

  • RHSA-2018:3221 Released 2018-10-30 · Red Hat rating Moderate
    openssl security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
    • Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.2k-16.el7, openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
    • Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.2k-16.el7, openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
    • Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7.ppc +2
    • Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7.ppc
    • Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
    • Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) openssl-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Virtualization 3AffectedNo fix planned: Will not fix
Red Hat JBoss Core ServicesAffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 5AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 1AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Will not fix
Red Hat JBoss Web Server 3AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2018:3221
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2018:3221
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2018:3221
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2018:3221
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2018:3221
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2018:3221
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2018:3221
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2018:3221
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2018:3221
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2018:3221

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3735
  2. 2026-10-03 Alias added: GHSA-6h3q-hmhp-4vgv

References

Patch 1

Advisory 11

Other 13

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
See all 312 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences