Constructed ASN.1 types with a recursive definition could exceed the stack
Priority MEDIUM 47CWE-674Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 16 fixed, 6 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-674.
Summary
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
Why it matters now
EPSS 0.18596 97th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 16 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g); Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n) | — | No fix listed | CNA |
- OpenSSL VendorOpenSSL Affected Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g); Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n) Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | 1.0.2b – 1.0.2n; 1.1.0 – 1.1.0g | Vulnerable | OpenSSL |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* | 17.10 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.0.2b – 1.0.2n; 1.1.0 – 1.1.0g Vulnerable ·OpenSSL
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* Versions 17.10 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
Red Hat 6 advisories
- RHSA-2019:1712 Released 2019-07-09 · Red Hat rating ImportantRed Hat JBoss Web Server 3.1 Service Pack 7 security and bug fix update
- Red Hat JBoss Web Server 3.1
- RHSA-2019:1711 Released 2019-07-09 · Red Hat rating ModerateRed Hat JBoss Web Server 3.1 Service Pack 7 security and bug fix update
- Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat-native-1.2.17-19.redhat_19.ep7.el6, tomcat7-7.0.70-34.ep7.el6, tomcat7-admin-webapps-7.0.70-34.ep7.el6 +22
- Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat-native-1.2.17-19.redhat_19.ep7.el7, tomcat7-7.0.70-34.ep7.el7, tomcat7-admin-webapps-7.0.70-34.ep7.el7 +22
- RHSA-2019:0367 Released 2019-02-18 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.29 security update
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-1-6.jbcs.el6, jbcs-httpd24-apache-commons-daemon-jsvc-1:1.1.0-3.redhat_2.jbcs.el6, jbcs-httpd24-apr-1.6.3-31.jbcs.el6 +31
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-1-6.jbcs.el7, jbcs-httpd24-apache-commons-daemon-jsvc-1:1.1.0-3.redhat_2.jbcs.el7, jbcs-httpd24-apr-1.6.3-31.jbcs.el7 +31
Show 3 more Red Hat advisories
- RHSA-2019:0366 Released 2019-02-18 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.29 SP1 security update
- Red Hat JBoss Core Services
- RHSA-2018:3221 Released 2018-10-30 · Red Hat rating Moderateopenssl security, bug fix, and enhancement update
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.2k-16.el7, openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.2k-16.el7, openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7.ppc
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) openssl-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
- RHSA-2018:3090 Released 2018-10-30 · Red Hat rating Moderateovmf security, bug fix, and enhancement update
- Red Hat Enterprise Linux Server (v. 7) OVMF-20180508-3.gitee3198e672e2.el7, ovmf-20180508-3.gitee3198e672e2.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) AAVMF-20180508-3.gitee3198e672e2.el7, ovmf-20180508-3.gitee3198e672e2.el7
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2018:3221 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2018:3221 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2018:3221 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2018:3221 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2018:3090, RHSA-2018:3221 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2018:3221 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2018:3221 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2018:3221 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) | Fixed | RHSA-2018:3221 |
| Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) | Fixed | RHSA-2018:3090, RHSA-2018:3221 |
| Red Hat JBoss Core Services | Fixed | RHSA-2019:0366 |
| Red Hat JBoss Core Services on RHEL 6 Server | Fixed | RHSA-2019:0367 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2019:0367 |
| Red Hat JBoss Web Server 3.1 | Fixed | RHSA-2019:1712 |
| Red Hat JBoss Web Server 3.1 for RHEL 6 | Fixed | RHSA-2019:1711 |
| Red Hat JBoss Web Server 3.1 for RHEL 7 | Fixed | RHSA-2019:1711 |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2018-0739
- 2026-10-03 Alias added: GHSA-2qcx-c97v-hcr6
References
Advisory 16
- USN-3611-2
- DSA-4158
- GLSA-201811-21
- RHSA-2019:0367
- DSA-4157
- RHSA-2018:3505
- RHSA-2018:3221
- USN-3611-1
- [debian-lts-announce] 20180330 [SECURITY] [DLA 1330-1] openssl security update
- RHSA-2019:0366
- RHSA-2018:3090
- RHSA-2019:1711
- RHSA-2019:1712
- GLSA-202007-53
- https://security.netapp.com/advisory/ntap-20180330-0002/
- https://www.openssl.org/news/secadv/20180327.txt
Other 14
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://security.netapp.com/advisory/ntap-20180726-0002/
- https://securityadvisories.paloaltonetworks.com/Home/Detail/133
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.tenable.com/security/tns-2018-07
- https://www.tenable.com/security/tns-2018-04
- https://nodejs.org/en/blog/vulnerability/march-2018-security-releases/
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2ac4c6f7b2b2af20c0e2b0ba05367e454cd11b33
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9310d45087ae546e27e61ddf8f6367f29848220d
- https://www.tenable.com/security/tns-2018-06
More Openssl vulnerabilities
- TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
- TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
Sources
- CVE-2018-0739 · CVE Program
- CVE-2018-0739 · NVD
- FIRST EPSS
- GHSA-2qcx-c97v-hcr6 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-0739 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences