CVE-2017-3731
High
Description
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
SeverityHigh
CVSS7.5
Exploit probability99. percentile57.3%
Product
Openssl
PublishedMay 4, 2017
First seenMay 4, 2017
How to fix
Update
- nodejs node.js4.7.3, 6.9.5, 7.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openssl openssl | 1.1.0a, 1.1.0b, 1.1.0c, 1.0.2, 1.0.2a, 1.0.2b, 1.0.2c, 1.0.2d, 1.0.2e, 1.0.2f, 1.0.2h, 1.0.2i, 1.0.2j | — |
| nodejs node.js | 4.0.0 ≤ v ≤ 4.1.2, 4.2.0 ≤ v < 4.7.3, 5.0.0 ≤ v ≤ 5.12.0, 6.0.0 ≤ v ≤ 6.8.1, 6.9.0 ≤ v < 6.9.5, 7.0.0 ≤ v < 7.5.0 | 4.7.3, 6.9.5, 7.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.