CVE-2018-0735
Medium
Description
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).
SeverityMedium
CVSS5.9
Exploit probability92. percentile4.7%
Product
Openssl
PublishedOct 29, 2018
First seenOct 29, 2018
How to fix
Update
- nodejs node.js10.12.0, 11.3.0 or later
- oracle vm_virtualbox6.0.0, 5.2.24 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openssl openssl | 1.1.0 ≤ v ≤ 1.1.0i, 1.1.1 | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 18.10 | — |
| debian debian_linux | 8.0, 9.0 | — |
| nodejs node.js | 10.0.0 ≤ v < 10.12.0, 11.0.0 ≤ v < 11.3.0, 10.13.0 | 10.12.0, 11.3.0 |
| netapp cn1610_firmware | No range specified | — |
| netapp cloud_backup | No range specified | — |
| netapp element_software | No range specified | — |
| netapp oncommand_unified_manager | No range specified, 9.4 ≤ v | — |
| netapp santricity_smi-s_provider | No range specified | — |
| netapp smi-s_provider | No range specified | — |
| netapp snapdrive | No range specified | — |
| netapp steelstore | No range specified | — |
| oracle api_gateway | 11.1.2.4.0 | — |
| oracle application_server | 0.9.8, 1.0.0, 1.0.1 | — |
| oracle enterprise_manager_base_platform | 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0 | — |
| oracle enterprise_manager_ops_center | 12.3.3 | — |
| oracle mysql | v ≤ 5.6.42, 5.7.0 ≤ v ≤ 5.7.24, 8.0.0 ≤ v ≤ 8.0.13 | — |
| oracle peoplesoft_enterprise_peopletools | 8.55, 8.56, 8.57 | — |
| oracle primavera_p6_enterprise_project_portfolio_management | 17.7 ≤ v ≤ 17.12, 8.4, 15.1, 15.2, 16.1, 16.2, 18.8 | — |
| oracle secure_global_desktop | 5.4 | — |
| oracle tuxedo | 12.1.1.0.0 | — |
| oracle vm_virtualbox | v < 6.0.0, 5.0.0 ≤ v < 5.2.24 | 6.0.0, 5.2.24 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.