{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201705-3649",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2h"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2i"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2f"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.1.0c"
      },
      {
        "model": "node.js",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "6.9.5"
      },
      {
        "model": "node.js",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "6.8.1"
      },
      {
        "model": "node.js",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "4.1.2"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2d"
      },
      {
        "model": "node.js",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "7.5.0"
      },
      {
        "model": "node.js",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "6.9.0"
      },
      {
        "model": "node.js",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "4.2.0"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2c"
      },
      {
        "model": "node.js",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "6.0.0"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.1.0b"
      },
      {
        "model": "node.js",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "4.7.3"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2a"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.1.0a"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2b"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2e"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "openssl",
        "version": "1.0.2"
      },
      {
        "model": "node.js",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "7.0.0"
      },
      {
        "model": "node.js",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "4.0.0"
      },
      {
        "model": "node.js",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "5.0.0"
      },
      {
        "model": "node.js",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "nodejs",
        "version": "5.12.0"
      },
      {
        "model": "jp1/automatic job management system 3",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "- manager web console"
      },
      {
        "model": "jp1/integrated management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "- service support starter edition"
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "openssl",
        "version": "1.1.0d"
      },
      {
        "model": "jp1/it desktop management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "2 - operations director"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "(64)"
      },
      {
        "model": "openssl",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "openssl",
        "version": "1.1.0"
      },
      {
        "model": "systemdirector enterprise",
        "scope": null,
        "trust": 0.8,
        "vendor": "nec",
        "version": null
      },
      {
        "model": "enterprisedirectoryserver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "nec",
        "version": "all versions"
      },
      {
        "model": "job management partner 1/integrated management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "- service support"
      },
      {
        "model": "webotx application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "nec",
        "version": "foundation"
      },
      {
        "model": "job management partner 1/it desktop management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "2 - smart device manager"
      },
      {
        "model": "jp1/performance management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "- web console"
      },
      {
        "model": "express5800",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "nec",
        "version": "/sg all versions"
      },
      {
        "model": "webotx enterprise service bus",
        "scope": null,
        "trust": 0.8,
        "vendor": "nec",
        "version": null
      },
      {
        "model": "openssl",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "openssl",
        "version": "1.0.2k"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "(64)"
      },
      {
        "model": "jp1/performance management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "- manager"
      },
      {
        "model": "jp1/it desktop management - manager",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "jp1/automatic operation",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "job management partner 1/performance management - web console",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "job management partner 1/it desktop management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "2 - manager"
      },
      {
        "model": "webotx application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "nec",
        "version": "st ard"
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "none"
      },
      {
        "model": "jp1/it desktop management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "2 - smart device manager"
      },
      {
        "model": "jp1/integrated management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "- service support"
      },
      {
        "model": "ucosminexus primary server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "base"
      },
      {
        "model": "ucosminexus primary server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "base(64)"
      },
      {
        "model": "job management partner 1/integrated management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "- service support advanced edition"
      },
      {
        "model": "ucosminexus service platform",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "none"
      },
      {
        "model": "it operations director",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "jp1/service support",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "none"
      },
      {
        "model": "jp1/operations analytics",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "jp1/service support",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "starter edition"
      },
      {
        "model": "cosminexus http server",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "ucosminexus application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "-r"
      },
      {
        "model": "jp1/it desktop management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "2 - manager"
      },
      {
        "model": "job management partner 1/it desktop management - manager",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "ucosminexus service architect",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "webotx application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "nec",
        "version": "express"
      },
      {
        "model": "esmpro/serveragentservice",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "nec",
        "version": "all versions  (linux edition )"
      },
      {
        "model": "jp1/performance management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "- manager web console"
      },
      {
        "model": "openssl",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "openssl",
        "version": "1.0.2"
      },
      {
        "model": "webotx portal",
        "scope": null,
        "trust": 0.8,
        "vendor": "nec",
        "version": null
      },
      {
        "model": "ucosminexus developer",
        "scope": null,
        "trust": 0.8,
        "vendor": "hitachi",
        "version": null
      },
      {
        "model": "webotx application server",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "nec",
        "version": "enterprise"
      },
      {
        "model": "jp1/integrated management",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "hitachi",
        "version": "- service support advanced edition"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-3732"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:openssl:openssl",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:nec:enterprise_directoryserver",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:nec:esmpro_serveragent",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:nec:esmpro_serveragentservice",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/h:nec:express5800",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:nec:systemdirector_enterprise",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:nec:webotx_application_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:nec:webotx_enterprise_service_bus",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:nec:webotx_portal",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:cosminexus_http_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:it_operations_director",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_integrated_management",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:job_management_partner_1%2Fit_desktop_management-manager",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:job_management_partner_1_performance_management_web_console",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:jp1_automatic_job_management_system_3",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:jp1_automatic_operation",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:jp1_integrated_management",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:jp1_it_desktop_management",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:jp1%2Fit_desktop_management-manager",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:jp1_operation_analytics",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:jp1_performance_management",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:jp1_service_support",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_application_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_developer",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_primary_server",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_architect",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:hitachi:ucosminexus_service_platform",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Red Hat",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "148521"
      },
      {
        "db": "PACKETSTORM",
        "id": "148525"
      }
    ],
    "trust": 0.2
  },
  "cve": "CVE-2017-3732",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2017-3732",
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.2,
            "id": "CVE-2017-3732",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 5.9,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2017-3732",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-3732",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-3732",
            "trust": 0.8,
            "value": "Medium"
          },
          {
            "author": "VULMON",
            "id": "CVE-2017-3732",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-3732"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-3732"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL 1.0.2 before 1.0.2k and 1.1.0 before 1.1.0d. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH are considered just feasible (although very difficult) because most of the work necessary to deduce information about a private key may be performed offline. The amount of resources required for such an attack would be very significant and likely only accessible to a limited number of attackers. An attacker would additionally need online access to an unpatched system using the target private key in a scenario with persistent DH parameters and a private key that is shared between multiple clients. For example this can occur by default in OpenSSL DHE based SSL/TLS ciphersuites. Note: This issue is very similar to CVE-2015-3193 but must be treated as a separate problem. OpenSSL There is a service disruption ( crash ) There are vulnerabilities that are put into a state.Service operation interruption ( crash ) There is a possibility of being put into a state. \nOpenSSL Security Advisory [07 Dec 2017]\n========================================\n\nRead/write after SSL object in error state (CVE-2017-3737)\n==========================================================\n\nSeverity: Moderate\n\nOpenSSL 1.0.2 (starting from version 1.0.2b) introduced an \"error state\"\nmechanism. The intent was that if a fatal error occurred during a handshake then\nOpenSSL would move into the error state and would immediately fail if you\nattempted to continue the handshake. This works as designed for the explicit\nhandshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()),\nhowever due to a bug it does not work correctly if SSL_read() or SSL_write() is\ncalled directly. In that scenario, if the handshake fails then a fatal error\nwill be returned in the initial function call. If SSL_read()/SSL_write() is\nsubsequently called by the application for the same SSL object then it will\nsucceed and the data is passed without being decrypted/encrypted directly from\nthe SSL/TLS record layer. \n\nIn order to exploit this issue an application bug would have to be present that\nresulted in a call to SSL_read()/SSL_write() being issued after having already\nreceived a fatal error. \n\nThis issue does not affect OpenSSL 1.1.0. \n\nOpenSSL 1.0.2 users should upgrade to 1.0.2n\n\nThis issue was reported to OpenSSL on 10th November 2017 by David Benjamin\n(Google). The fix was proposed by David Benjamin and implemented by Matt Caswell\nof the OpenSSL development team. \n\nrsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)\n=========================================================\n\nSeverity: Low\n\nThere is an overflow bug in the AVX2 Montgomery multiplication procedure\nused in exponentiation with 1024-bit moduli. \n\nThis only affects processors that support the AVX2 but not ADX extensions\nlike Intel Haswell (4th generation). \n\nDue to the low severity of this issue we are not issuing a new release of\nOpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h when it\nbecomes available. The fix is also available in commit e502cc86d in the OpenSSL\ngit repository. \n\nOpenSSL 1.0.2 users should upgrade to 1.0.2n\n\nThis issue was reported to OpenSSL on 22nd November 2017 by David Benjamin\n(Google). The issue was originally found via the OSS-Fuzz project. The fix was\ndeveloped by Andy Polyakov of the OpenSSL development team. \n\nNote\n====\n\nSupport for version 1.0.1 ended on 31st December 2016. Support for versions\n0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer\nreceiving security updates. \n\nReferences\n==========\n\nURL for this Security Advisory:\nhttps://www.openssl.org/news/secadv/20171207.txt\n\nNote: the online version of the advisory may be updated with additional details\nover time. \n\nFor details of OpenSSL severity classifications please see:\nhttps://www.openssl.org/policies/secpolicy.html\n. \nOpenSSL Security Advisory [27 Mar 2018]\n========================================\n\nConstructed ASN.1 types with a recursive definition could exceed the stack (CVE-2018-0739)\n==========================================================================================\n\nSeverity: Moderate\n\nConstructed ASN.1 types with a recursive definition (such as can be found in\nPKCS7) could eventually exceed the stack given malicious input with\nexcessive recursion. This could result in a Denial Of Service attack. There are\nno such structures used within SSL/TLS that come from untrusted sources so this\nis considered safe. \n\nIncorrect CRYPTO_memcmp on HP-UX PA-RISC (CVE-2018-0733)\n========================================================\n\nSeverity: Moderate\n\nBecause of an implementation bug the PA-RISC CRYPTO_memcmp function is\neffectively reduced to only comparing the least significant bit of each byte. \nThis allows an attacker to forge messages that would be considered as\nauthenticated in an amount of tries lower than that guaranteed by the security\nclaims of the scheme. The module can only be compiled by the HP-UX assembler, so\nthat only HP-UX PA-RISC targets are affected. Solution:\n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss Web Server installation (including all applications\nand configuration files). \n\nAfter installing the updated packages, the httpd daemon will be restarted\nautomatically. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 security update\nAdvisory ID:       RHSA-2018:2186-01\nProduct:           Red Hat JBoss Core Services\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2018:2186\nIssue date:        2018-07-12\nCVE Names:         CVE-2016-2182 CVE-2016-6302 CVE-2016-6306\n                   CVE-2016-7055 CVE-2017-3731 CVE-2017-3732\n                   CVE-2017-3736 CVE-2017-3737 CVE-2017-3738\n====================================================================\n1. Summary:\n\nRed Hat JBoss Core Services Pack Apache Server 2.4.29 packages are now\navailable for Red Hat Enterprise Linux 6. \n\nRed Hat Product Security has rated this release as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. Relevant releases/architectures:\n\nRed Hat JBoss Core Services on RHEL 6 Server - i386, noarch, x86_64\n\n3. Description:\n\nThis release adds the new Apache HTTP Server 2.4.29 packages that are part\nof the JBoss Core Services offering. \n\nThis release serves as a replacement for Red Hat JBoss Core Services\nApache HTTP Server 2.4.23, and includes bug fixes and enhancements. Refer\nto the Release Notes for information on the most significant bug fixes,\nenhancements and component upgrades included in this release. \n\nThis release upgrades OpenSSL to version 1.0.2.n\n\nSecurity Fix(es):\n\n*  openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec()\n(CVE-2016-2182)\n\n*  openssl: Insufficient TLS session ticket HMAC length checks\n(CVE-2016-6302)\n\n*  openssl: certificate message OOB reads (CVE-2016-6306)\n\n*  openssl: Carry propagating bug in Montgomery multiplication\n(CVE-2016-7055)\n\n*  openssl: Truncated packet could crash via OOB read (CVE-2017-3731)\n\n*  openssl: BN_mod_exp may produce incorrect results on x86_64\n(CVE-2017-3732)\n\n*  openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)\n\n*  openssl: Read/write after SSL object in error state (CVE-2017-3737)\n\n*  openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)\n\nRed Hat would like to thank the OpenSSL project for reporting CVE-2016-6306\nand CVE-2016-7055. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360\nInc.) as the original reporter of CVE-2016-6306. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1367340 - CVE-2016-2182 openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec()\n1369855 - CVE-2016-6302 openssl: Insufficient TLS session ticket HMAC length checks\n1377594 - CVE-2016-6306 openssl: certificate message OOB reads\n1393929 - CVE-2016-7055 openssl: Carry propagating bug in Montgomery multiplication\n1416852 - CVE-2017-3731 openssl: Truncated packet could crash via OOB read\n1416856 - CVE-2017-3732 openssl: BN_mod_exp may produce incorrect results on x86_64\n1509169 - CVE-2017-3736 openssl: bn_sqrx8x_internal carry bug on x86_64\n1523504 - CVE-2017-3737 openssl: Read/write after SSL object in error state\n1523510 - CVE-2017-3738 openssl: rsaz_1024_mul_avx2 overflow bug on x86_64\n\n6. JIRA issues fixed (https://issues.jboss.org/):\n\nJBCS-372 - Errata for httpd 2.4.29 GA RHEL 6\n\n7. Package List:\n\nRed Hat JBoss Core Services on RHEL 6 Server:\n\nSource:\njbcs-httpd24-apache-commons-daemon-1.1.0-1.redhat_2.1.jbcs.el6.src.rpm\njbcs-httpd24-apache-commons-daemon-jsvc-1.1.0-1.redhat_2.jbcs.el6.src.rpm\njbcs-httpd24-apr-1.6.3-14.jbcs.el6.src.rpm\njbcs-httpd24-apr-util-1.6.1-9.jbcs.el6.src.rpm\njbcs-httpd24-httpd-2.4.29-17.jbcs.el6.src.rpm\njbcs-httpd24-mod_auth_kerb-5.4-36.jbcs.el6.src.rpm\njbcs-httpd24-mod_bmx-0.9.6-17.GA.jbcs.el6.src.rpm\njbcs-httpd24-mod_cluster-native-1.3.8-1.Final_redhat_2.jbcs.el6.src.rpm\njbcs-httpd24-mod_jk-1.2.43-1.redhat_1.jbcs.el6.src.rpm\njbcs-httpd24-mod_rt-2.4.1-19.GA.jbcs.el6.src.rpm\njbcs-httpd24-mod_security-2.9.1-23.GA.jbcs.el6.src.rpm\njbcs-httpd24-nghttp2-1.29.0-8.jbcs.el6.src.rpm\njbcs-httpd24-openssl-1.0.2n-11.jbcs.el6.src.rpm\n\ni386:\njbcs-httpd24-apache-commons-daemon-jsvc-1.1.0-1.redhat_2.jbcs.el6.i686.rpm\njbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.1.0-1.redhat_2.jbcs.el6.i686.rpm\njbcs-httpd24-apr-1.6.3-14.jbcs.el6.i686.rpm\njbcs-httpd24-apr-debuginfo-1.6.3-14.jbcs.el6.i686.rpm\njbcs-httpd24-apr-devel-1.6.3-14.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-debuginfo-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-devel-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-ldap-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-mysql-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-nss-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-odbc-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-openssl-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-pgsql-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-apr-util-sqlite-1.6.1-9.jbcs.el6.i686.rpm\njbcs-httpd24-httpd-2.4.29-17.jbcs.el6.i686.rpm\njbcs-httpd24-httpd-debuginfo-2.4.29-17.jbcs.el6.i686.rpm\njbcs-httpd24-httpd-devel-2.4.29-17.jbcs.el6.i686.rpm\njbcs-httpd24-httpd-selinux-2.4.29-17.jbcs.el6.i686.rpm\njbcs-httpd24-httpd-tools-2.4.29-17.jbcs.el6.i686.rpm\njbcs-httpd24-mod_auth_kerb-5.4-36.jbcs.el6.i686.rpm\njbcs-httpd24-mod_auth_kerb-debuginfo-5.4-36.jbcs.el6.i686.rpm\njbcs-httpd24-mod_bmx-0.9.6-17.GA.jbcs.el6.i686.rpm\njbcs-httpd24-mod_bmx-debuginfo-0.9.6-17.GA.jbcs.el6.i686.rpm\njbcs-httpd24-mod_cluster-native-1.3.8-1.Final_redhat_2.jbcs.el6.i686.rpm\njbcs-httpd24-mod_cluster-native-debuginfo-1.3.8-1.Final_redhat_2.jbcs.el6.i686.rpm\njbcs-httpd24-mod_jk-ap24-1.2.43-1.redhat_1.jbcs.el6.i686.rpm\njbcs-httpd24-mod_jk-debuginfo-1.2.43-1.redhat_1.jbcs.el6.i686.rpm\njbcs-httpd24-mod_jk-manual-1.2.43-1.redhat_1.jbcs.el6.i686.rpm\njbcs-httpd24-mod_ldap-2.4.29-17.jbcs.el6.i686.rpm\njbcs-httpd24-mod_proxy_html-2.4.29-17.jbcs.el6.i686.rpm\njbcs-httpd24-mod_rt-2.4.1-19.GA.jbcs.el6.i686.rpm\njbcs-httpd24-mod_rt-debuginfo-2.4.1-19.GA.jbcs.el6.i686.rpm\njbcs-httpd24-mod_security-2.9.1-23.GA.jbcs.el6.i686.rpm\njbcs-httpd24-mod_security-debuginfo-2.9.1-23.GA.jbcs.el6.i686.rpm\njbcs-httpd24-mod_session-2.4.29-17.jbcs.el6.i686.rpm\njbcs-httpd24-mod_ssl-2.4.29-17.jbcs.el6.i686.rpm\njbcs-httpd24-nghttp2-1.29.0-8.jbcs.el6.i686.rpm\njbcs-httpd24-nghttp2-debuginfo-1.29.0-8.jbcs.el6.i686.rpm\njbcs-httpd24-nghttp2-devel-1.29.0-8.jbcs.el6.i686.rpm\njbcs-httpd24-openssl-1.0.2n-11.jbcs.el6.i686.rpm\njbcs-httpd24-openssl-debuginfo-1.0.2n-11.jbcs.el6.i686.rpm\njbcs-httpd24-openssl-devel-1.0.2n-11.jbcs.el6.i686.rpm\njbcs-httpd24-openssl-libs-1.0.2n-11.jbcs.el6.i686.rpm\njbcs-httpd24-openssl-perl-1.0.2n-11.jbcs.el6.i686.rpm\njbcs-httpd24-openssl-static-1.0.2n-11.jbcs.el6.i686.rpm\n\nnoarch:\njbcs-httpd24-apache-commons-daemon-1.1.0-1.redhat_2.1.jbcs.el6.noarch.rpm\njbcs-httpd24-httpd-manual-2.4.29-17.jbcs.el6.noarch.rpm\n\nx86_64:\njbcs-httpd24-apache-commons-daemon-jsvc-1.1.0-1.redhat_2.jbcs.el6.x86_64.rpm\njbcs-httpd24-apache-commons-daemon-jsvc-debuginfo-1.1.0-1.redhat_2.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-1.6.3-14.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-debuginfo-1.6.3-14.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-devel-1.6.3-14.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-debuginfo-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-devel-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-ldap-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-mysql-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-nss-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-odbc-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-openssl-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-pgsql-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-apr-util-sqlite-1.6.1-9.jbcs.el6.x86_64.rpm\njbcs-httpd24-httpd-2.4.29-17.jbcs.el6.x86_64.rpm\njbcs-httpd24-httpd-debuginfo-2.4.29-17.jbcs.el6.x86_64.rpm\njbcs-httpd24-httpd-devel-2.4.29-17.jbcs.el6.x86_64.rpm\njbcs-httpd24-httpd-selinux-2.4.29-17.jbcs.el6.x86_64.rpm\njbcs-httpd24-httpd-tools-2.4.29-17.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_auth_kerb-5.4-36.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_auth_kerb-debuginfo-5.4-36.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_bmx-0.9.6-17.GA.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_bmx-debuginfo-0.9.6-17.GA.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_cluster-native-1.3.8-1.Final_redhat_2.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_cluster-native-debuginfo-1.3.8-1.Final_redhat_2.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_jk-ap24-1.2.43-1.redhat_1.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_jk-debuginfo-1.2.43-1.redhat_1.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_jk-manual-1.2.43-1.redhat_1.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_ldap-2.4.29-17.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_proxy_html-2.4.29-17.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_rt-2.4.1-19.GA.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_rt-debuginfo-2.4.1-19.GA.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_security-2.9.1-23.GA.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_security-debuginfo-2.9.1-23.GA.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_session-2.4.29-17.jbcs.el6.x86_64.rpm\njbcs-httpd24-mod_ssl-2.4.29-17.jbcs.el6.x86_64.rpm\njbcs-httpd24-nghttp2-1.29.0-8.jbcs.el6.x86_64.rpm\njbcs-httpd24-nghttp2-debuginfo-1.29.0-8.jbcs.el6.x86_64.rpm\njbcs-httpd24-nghttp2-devel-1.29.0-8.jbcs.el6.x86_64.rpm\njbcs-httpd24-openssl-1.0.2n-11.jbcs.el6.x86_64.rpm\njbcs-httpd24-openssl-debuginfo-1.0.2n-11.jbcs.el6.x86_64.rpm\njbcs-httpd24-openssl-devel-1.0.2n-11.jbcs.el6.x86_64.rpm\njbcs-httpd24-openssl-libs-1.0.2n-11.jbcs.el6.x86_64.rpm\njbcs-httpd24-openssl-perl-1.0.2n-11.jbcs.el6.x86_64.rpm\njbcs-httpd24-openssl-static-1.0.2n-11.jbcs.el6.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n8. References:\n\nhttps://access.redhat.com/security/cve/CVE-2016-2182\nhttps://access.redhat.com/security/cve/CVE-2016-6302\nhttps://access.redhat.com/security/cve/CVE-2016-6306\nhttps://access.redhat.com/security/cve/CVE-2016-7055\nhttps://access.redhat.com/security/cve/CVE-2017-3731\nhttps://access.redhat.com/security/cve/CVE-2017-3732\nhttps://access.redhat.com/security/cve/CVE-2017-3736\nhttps://access.redhat.com/security/cve/CVE-2017-3737\nhttps://access.redhat.com/security/cve/CVE-2017-3738\nhttps://access.redhat.com/security/updates/classification/#moderate\nhttps://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.29/\n\n9. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2018 Red Hat, Inc. \n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n+--------------------------+\npatches/packages/openssl-1.0.2k-i586-1_slack14.2.txz:  Upgraded. \n+--------------------------+\n\n\nWhere to find the new packages:\n+-----------------------------+\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project!  :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you. \n\nUpdated packages for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-1.0.2k-i586-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-solibs-1.0.2k-i586-1_slack14.2.txz\n\nUpdated packages for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-1.0.2k-x86_64-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-solibs-1.0.2k-x86_64-1_slack14.2.txz\n\nUpdated packages for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-1.0.2k-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-1.0.2k-i586-1.txz\n\nUpdated packages for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/openssl-solibs-1.0.2k-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssl-1.0.2k-x86_64-1.txz\n\n\nMD5 signatures:\n+-------------+\n\nSlackware 14.2 packages:\n1d03d7f59dece41b97104cbe8341b812  openssl-1.0.2k-i586-1_slack14.2.txz\nc5e689d9ac1c1675c5059b8e7cd42594  openssl-solibs-1.0.2k-i586-1_slack14.2.txz\n\nSlackware x86_64 14.2 packages:\n5e075d516ab7ccc1ef14f430e599bdef  openssl-1.0.2k-x86_64-1_slack14.2.txz\n110479b47a4208bcdb43fee59b9f06ca  openssl-solibs-1.0.2k-x86_64-1_slack14.2.txz\n\nSlackware -current packages:\n8eca7a113cf58688dc6203c4091fd0ac  a/openssl-solibs-1.0.2k-i586-1.txz\n1ee03441f6409e48dda42c006ae5a7ad  n/openssl-1.0.2k-i586-1.txz\n\nSlackware x86_64 -current packages:\n51ed87062d6898bd50705b2c2abc2c68  a/openssl-solibs-1.0.2k-x86_64-1.txz\nd9e56ff59fd7aa5791bf6809ccea0f92  n/openssl-1.0.2k-x86_64-1.txz\n\n\nInstallation instructions:\n+------------------------+\n\nUpgrade the packages as root:\n# upgradepkg openssl-1.0.2k-i586-1_slack14.2.txz openssl-solibs-1.0.2k-i586-1_slack14.2.txz \n\n\n+-----+\n\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list:                          |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message:                                                     |\n|                                                                        |\n|   unsubscribe slackware-security                                       |\n|                                                                        |\n| You will get a confirmation message back containing instructions to    |\n| complete the process.  Please do not reply to this email address. \n\nBackground\n==========\n\nA fast, multi-threaded, multi-user SQL database server. \n\nImpact\n======\n\nA remote attacker could execute arbitrary code without authentication\nor cause a partial denial of service condition. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n\n. \n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 201702-07\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: OpenSSL: Multiple vulnerabilities\n     Date: February 14, 2017\n     Bugs: #607318\n       ID: 201702-07\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in OpenSSL, the worst of which\nmight allow attackers to access sensitive information. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  dev-libs/openssl             \u003c 1.0.2k                  \u003e= 1.0.2k\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in OpenSSL. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n======\n\nA remote attacker is able to crash applications linked against OpenSSL\nor could obtain sensitive private-key information via an attack against\nthe Diffie-Hellman (DH) ciphersuite. \n\nResolution\n==========\n\nAll OpenSSL users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=dev-libs/openssl-1.0.2k\"\n\nReferences\n==========\n\n[ 1 ] CVE-2016-7055\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-7055\n[ 2 ] CVE-2017-3730\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3730\n[ 3 ] CVE-2017-3731\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3731\n[ 4 ] CVE-2017-3732\n      http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3732\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/201702-07\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2017 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttp://creativecommons.org/licenses/by-sa/2.5\n\n\n--6TxcaqolfH5V8d0tqHGgGlj1v2tmUA9I9--\n\n. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n=============================================================================\nFreeBSD-SA-17:02.openssl                                    Security Advisory\n                                                          The FreeBSD Project\n\nTopic:          OpenSSL multiple vulnerabilities\n\nCategory:       contrib\nModule:         openssl\nAnnounced:      2017-02-23\nAffects:        All supported versions of FreeBSD. \nCorrected:      2017-01-26 19:14:14 UTC (stable/11, 11.0-STABLE)\n                2017-02-23 07:11:48 UTC (releng/11.0, 11.0-RELEASE-p8)\n                2017-01-27 07:45:06 UTC (stable/10, 10.3-STABLE)\n                2017-02-23 07:12:18 UTC (releng/10.3, 10.3-RELEASE-p16)\nCVE Name:       CVE-2016-7055, CVE-2017-3731, CVE-2017-3732\n\nFor general information regarding FreeBSD Security Advisories,\nincluding descriptions of the fields above, security branches, and the\nfollowing sections, please visit \u003cURL:https://security.FreeBSD.org/\u003e. \n\nI.   Background\n\nFreeBSD includes software from the OpenSSL Project.  The OpenSSL Project is\na collaborative effort to develop a robust, commercial-grade, full-featured\nOpen Source toolkit implementing the Secure Sockets Layer (SSL v2/v3)\nand Transport Layer Security (TLS v1) protocols as well as a full-strength\ngeneral purpose cryptography library. \n\nII.  Problem Description\n\nIf an SSL/TLS server or client is running on a 32-bit host, and a specific\ncipher is being used, then a truncated packet can cause that server or\nclient to perform an out-of-bounds read, usually resulting in a crash. [CVE-2017-3732]\n\nMontgomery multiplication may produce incorrect results. [CVE-2016-7055]\n\nIII. Impact\n\nA remote attacker may trigger a crash on servers or clients that supported\nRC4-MD5. [CVE-2017-3732,\nCVE-2016-7055]\n\nIV.  Workaround\n\nNo workaround is available. \n\nV.   Solution\n\nPerform one of the following:\n\n1) Upgrade your vulnerable system to a supported FreeBSD stable or\nrelease / security branch (releng) dated after the correction date. \n\nRestart all daemons that use the library, or reboot the system. \n\n2) To update your vulnerable system via a binary patch:\n\nSystems running a RELEASE version of FreeBSD on the i386 or amd64\nplatforms can be updated via the freebsd-update(8) utility:\n\n# freebsd-update fetch\n# freebsd-update install\n\nRestart all daemons that use the library, or reboot the system. \n\n3) To update your vulnerable system via a source code patch:\n\nThe following patches have been verified to apply to the applicable\nFreeBSD release branches. \n\na) Download the relevant patch from the location below, and verify the\ndetached PGP signature using your PGP utility. \n\n[FreeBSD 11.0]\n# fetch https://security.FreeBSD.org/patches/SA-17:02/openssl-11.patch\n# fetch https://security.FreeBSD.org/patches/SA-17:02/openssl-11.patch.asc\n# gpg --verify openssl-11.patch.asc\n\n[FreeBSD 10.3]\n# fetch https://security.FreeBSD.org/patches/SA-17:02/openssl-10.patch\n# fetch https://security.FreeBSD.org/patches/SA-17:02/openssl-10.patch.asc\n# gpg --verify openssl-10.patch.asc\n\nb) Apply the patch.  Execute the following commands as root:\n\n# cd /usr/src\n# patch \u003c /path/to/patch\n\nc) Recompile the operating system using buildworld and installworld as\ndescribed in \u003cURL:https://www.FreeBSD.org/handbook/makeworld.html\u003e. \n\nRestart all daemons that use the library, or reboot the system. \n\nVI.  Correction details\n\nThe following list contains the correction revision numbers for each\naffected branch. \n\nBranch/path                                                      Revision\n- -------------------------------------------------------------------------\nstable/10/                                                        r312863\nreleng/10.3/                                                      r314125\nstable/11/                                                        r312826\nreleng/11.0/                                                      r314126\n- -------------------------------------------------------------------------\n\nTo see which files were modified by a particular revision, run the\nfollowing command, replacing NNNNNN with the revision number, on a\nmachine with Subversion installed:\n\n# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base\n\nOr visit the following URL, replacing NNNNNN with the revision number:\n\n\u003cURL:https://svnweb.freebsd.org/base?view=revision\u0026revision=NNNNNN\u003e\n\nVII. References\n\n\u003cURL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7055\u003e \n\n\u003cURL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3731\u003e \n\n\u003cURL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3732\u003e\n\n\u003cURL:https://www.openssl.org/news/secadv/20170126.txt\u003e\n\nThe latest revision of this advisory is available at\n\u003cURL:https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc\u003e\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v2.1.18 (FreeBSD)\n\niQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAliujOsACgkQ7Wfs1l3P\naufZHhAAy8U5oOrLGq0XH8Dumpkyc+bFOmsEh+S1hL6jFL13jUVpDqogZ3w/a7If\nHcqiyipx5dbcGbHJayokfimkxPcIYydYQK9NwWaXVlnZifvgWka+KxtcD0u2A8S5\ncpTbNl+CALQQqEF3+JmOc4Uq2Dtui0xFG1N5Og4oF5Uo+lvQh4bcJ1UbfhMdq8EG\nUS3hGlJLJJW75m3jkgHyu0o7A0swnNTUQrW9Z0p/3iTiel7fM57d/N1who+kt59V\nUErXTzMDBT1kkWRne0aTA71gdy3SUeRiVi9/LWggjIRJNyMnQjO3UI2UOIHLLQAG\nCXcZLPekB87iHZxMAw8oV6b4GIkJhqUFW2ep2AZkUdDZ2Mup9bDrx/0Ik0jHjyQY\nKEmZDroHvP8z569q+aWfIIpMXPv6zJTnent45U2/q13wMHJwWsADu9ukeWKTw7wI\nP0Rc3vht+AXbXFi9SjxwdldgrVszV7x8Yi6W9KhHsGqCl6NBCW9Md/PWbNQQUVkq\nI5tV0WB3pTwOk0yMi3h/okM9VBr1lPDU18W0he5T9wbOh4w0jwFb8AqMu1slst3l\n9MlhRfO/4LIDlfRQ/dj4dOfVLZqEd/xleax99yFXZUzibUYrOMlBxNaKvV80plwB\nKg2Hr3DJuJa3599kNgXMCNV1lRIOJbJ9dRmX6B0YzMgvxKPIXY4=\n=8Jsr\n-----END PGP SIGNATURE-----\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-3732"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-3732"
      },
      {
        "db": "PACKETSTORM",
        "id": "169655"
      },
      {
        "db": "PACKETSTORM",
        "id": "169626"
      },
      {
        "db": "PACKETSTORM",
        "id": "148521"
      },
      {
        "db": "PACKETSTORM",
        "id": "148525"
      },
      {
        "db": "PACKETSTORM",
        "id": "141025"
      },
      {
        "db": "PACKETSTORM",
        "id": "146486"
      },
      {
        "db": "PACKETSTORM",
        "id": "141088"
      },
      {
        "db": "PACKETSTORM",
        "id": "141255"
      }
    ],
    "trust": 2.43
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-3732",
        "trust": 2.7
      },
      {
        "db": "SECTRACK",
        "id": "1037717",
        "trust": 1.1
      },
      {
        "db": "BID",
        "id": "95814",
        "trust": 1.1
      },
      {
        "db": "TENABLE",
        "id": "TNS-2017-04",
        "trust": 1.1
      },
      {
        "db": "JVN",
        "id": "JVNVU92830136",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156",
        "trust": 0.8
      },
      {
        "db": "VULMON",
        "id": "CVE-2017-3732",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "169655",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "169626",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "148521",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "148525",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "141025",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "146486",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "141088",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "141255",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-3732"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      },
      {
        "db": "PACKETSTORM",
        "id": "169655"
      },
      {
        "db": "PACKETSTORM",
        "id": "169626"
      },
      {
        "db": "PACKETSTORM",
        "id": "148521"
      },
      {
        "db": "PACKETSTORM",
        "id": "148525"
      },
      {
        "db": "PACKETSTORM",
        "id": "141025"
      },
      {
        "db": "PACKETSTORM",
        "id": "146486"
      },
      {
        "db": "PACKETSTORM",
        "id": "141088"
      },
      {
        "db": "PACKETSTORM",
        "id": "141255"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-3732"
      }
    ]
  },
  "id": "VAR-201705-3649",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.206875005
  },
  "last_update_date": "2024-11-29T22:01:35.644000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "hitachi-sec-2018-103",
        "trust": 0.8,
        "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2018-103/index.html"
      },
      {
        "title": "hitachi-sec-2017-115",
        "trust": 0.8,
        "url": "http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2017-115/index.html"
      },
      {
        "title": "NV17-011",
        "trust": 0.8,
        "url": "http://jpn.nec.com/security-info/secinfo/nv17-011.html"
      },
      {
        "title": "BN_mod_exp may produce incorrect results on x86_64",
        "trust": 0.8,
        "url": "https://www.openssl.org/news/secadv/20170126.txt"
      },
      {
        "title": "hitachi-sec-2018-103",
        "trust": 0.8,
        "url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2018-103/index.html"
      },
      {
        "title": "hitachi-sec-2017-115",
        "trust": 0.8,
        "url": "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2017-115/index.html"
      },
      {
        "title": "The Register",
        "trust": 0.2,
        "url": "https://www.theregister.co.uk/2017/01/31/openssl_patches/"
      },
      {
        "title": "Red Hat: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29  RHEL 7 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182185 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: java-1.8.0-ibm security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182575 - Security Advisory"
      },
      {
        "title": "Red Hat: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182186 - Security Advisory"
      },
      {
        "title": "Red Hat: Moderate: java-1.8.0-ibm security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182713 - Security Advisory"
      },
      {
        "title": "Red Hat: Important: java-1.8.0-ibm security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182568 - Security Advisory"
      },
      {
        "title": "Red Hat: Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=RHSA-20182187 - Security Advisory"
      },
      {
        "title": "Red Hat: CVE-2017-3732",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database\u0026qid=CVE-2017-3732"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=CVE-2017-3732"
      },
      {
        "title": "IBM: Security Bulletin: OpenSSL vulnerabilites impacting IBM Aspera Connect 3.7.4 and earlier (CVE-2017-3732, CVE-2016-7055)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=030cb7ac9266aec85453c1d2339fbc00"
      },
      {
        "title": "Ubuntu Security Notice: openssl vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-3181-1"
      },
      {
        "title": "Arch Linux Advisories: [ASA-201701-37] openssl: multiple issues",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201701-37"
      },
      {
        "title": "Huawei Security Advisories: Security Advisory - Three OpenSSL Vulnerabilities in Huawei Products",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=huawei_security_advisories\u0026qid=1181e052a6a83786d4182d45ddb56d5d"
      },
      {
        "title": "Symantec Security Advisories: SA141 : OpenSSL Vulnerabilities 26-Jan-2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories\u0026qid=117bc0d26e74d755d85acf15af842eaf"
      },
      {
        "title": "Arch Linux Advisories: [ASA-201701-36] lib32-openssl: multiple issues",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=ASA-201701-36"
      },
      {
        "title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Spectrum Protect Operations Center and Client Management Service (CVE-2016-0705, CVE-2017-3732, CVE-2017-3736, CVE-2018-1656, CVE-2018-12539)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=3d9ab13c871ea2142681c7977b25c5ff"
      },
      {
        "title": "IBM: IBM Security Bulletin: IBM SDK, Java Technology Edition Quarterly CPU \u2013 Jul 2018 \u2013 Includes Oracle Jul 2018 CPU affects DB2 Recovery Expert for Linux, Unix and Windows",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=af4ddb95056d65a4af347aec0f652f0e"
      },
      {
        "title": "Cisco: Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: January and February 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts\u0026qid=cisco-sa-20170130-openssl"
      },
      {
        "title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Cognos Planning",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=62ef85c9034c17315b7d0a712483c5ea"
      },
      {
        "title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Reporting for Development Intelligence",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=03b0267d78cd8ac1bbb43afc737474f0"
      },
      {
        "title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affects IBM InfoSphere Information Server",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=63bbfc68418161b36080acd59a541d45"
      },
      {
        "title": "IBM: IBM Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Privileged Identity Manager",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=42a34f9348fc5f34065c6d25764eb2a2"
      },
      {
        "title": "Debian CVElist Bug Report Logs: Security fixes from the July 2017 CPU",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=adc1e0c986afd5f2f3b0797ba936d072"
      },
      {
        "title": "IBM: IBM Security Bulletin: IBM Cognos Controller 2019Q2 Security Updater: Multiple vulnerabilities have been identified in IBM Cognos Controller",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=38227211accce022b0a3d9b56a974186"
      },
      {
        "title": "Forcepoint Security Advisories: CVE-2017-3730, -3731, -3732 OpenSSL Vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=forcepoint_security_advisories\u0026qid=16a227df38f44014c9520f3b6cb5344e"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=a2bac27fb002bed513645d4775c7275b"
      },
      {
        "title": "Tenable Security Advisories: [R5] SecurityCenter 5.4.3 Fixes Multiple Vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories\u0026qid=TNS-2017-04"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - April 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=a31bff03e9909229fd67996884614fdf"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - July 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=2f446a7e1ea263c0c3a365776c6713f2"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - July 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=5f8c525f1408011628af1792207b2099"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - July 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=586e6062440cdd312211d748e028164e"
      },
      {
        "title": "IBM: IBM Security Bulletin: IBM Security Privileged Identity Manager is affected by multiple vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=dd8c9d5928cc3b1ac8c35b4b24703e38"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - April 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=143b3fb255063c81571469eaa3cf0a87"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - October 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=523d3f220a64ff01dd95e064bd37566a"
      },
      {
        "title": "Oracle: Oracle Critical Patch Update Advisory - January 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_advisories\u0026qid=e2a7f287e9acc8c64ab3df71130bc64d"
      },
      {
        "title": "IBM: Security Bulletin: Multiple vulnerabilities in IBM Java affect IBM Netezza Analytics for NPS",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=c36fc403a4c2c6439b732d2fca738f58"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2018",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=525e4e31765e47b9e53b24e880af9d6e"
      },
      {
        "title": "Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - October 2017",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins\u0026qid=6283337cd31f81f24d445925f2138c0e"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-3732"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-200",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-3732"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3732"
      },
      {
        "trust": 1.2,
        "url": "https://www.openssl.org/news/secadv/20170126.txt"
      },
      {
        "trust": 1.2,
        "url": "https://security.gentoo.org/glsa/201702-07"
      },
      {
        "trust": 1.2,
        "url": "https://access.redhat.com/errata/rhsa-2018:2187"
      },
      {
        "trust": 1.2,
        "url": "https://access.redhat.com/errata/rhsa-2018:2186"
      },
      {
        "trust": 1.1,
        "url": "http://www.securityfocus.com/bid/95814"
      },
      {
        "trust": 1.1,
        "url": "http://www.securitytracker.com/id/1037717"
      },
      {
        "trust": 1.1,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"
      },
      {
        "trust": 1.1,
        "url": "https://www.tenable.com/security/tns-2017-04"
      },
      {
        "trust": 1.1,
        "url": "https://security.freebsd.org/advisories/freebsd-sa-17:02.openssl.asc"
      },
      {
        "trust": 1.1,
        "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
      },
      {
        "trust": 1.1,
        "url": "https://github.com/openssl/openssl/commit/a59b90bf491410f1f2bc4540cc21f1980fd14c5b"
      },
      {
        "trust": 1.1,
        "url": "https://access.redhat.com/errata/rhsa-2018:2185"
      },
      {
        "trust": 1.1,
        "url": "https://support.hpe.com/hpsc/doc/public/display?doclocale=en_us\u0026docid=emr_na-hpesbhf03838en_us"
      },
      {
        "trust": 1.1,
        "url": "https://access.redhat.com/errata/rhsa-2018:2568"
      },
      {
        "trust": 1.1,
        "url": "https://access.redhat.com/errata/rhsa-2018:2575"
      },
      {
        "trust": 1.1,
        "url": "https://access.redhat.com/errata/rhsa-2018:2713"
      },
      {
        "trust": 1.1,
        "url": "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
      },
      {
        "trust": 0.9,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3732"
      },
      {
        "trust": 0.8,
        "url": "https://jvn.jp/vu/jvnvu92830136/"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3731"
      },
      {
        "trust": 0.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-7055"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3738"
      },
      {
        "trust": 0.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3736"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3737"
      },
      {
        "trust": 0.2,
        "url": "https://www.openssl.org/policies/secpolicy.html"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-0701"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2015-3193"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-2182"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6302"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2017-3731"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2017-3737"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2016-6306"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.2,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2017-3738"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2017-3732"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2016-6306"
      },
      {
        "trust": 0.2,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_core_services/2.4.29/"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2016-2182"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2016-7055"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2016-6302"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2017-3736"
      },
      {
        "trust": 0.2,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.2,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.2,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/200.html"
      },
      {
        "trust": 0.1,
        "url": "https://tools.cisco.com/security/center/viewalert.x?alertid=52438"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/3181-1/"
      },
      {
        "trust": 0.1,
        "url": "https://www.openssl.org/news/secadv/20171207.txt"
      },
      {
        "trust": 0.1,
        "url": "https://www.openssl.org/news/secadv/20180327.txt"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-0739"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-0733"
      },
      {
        "trust": 0.1,
        "url": "https://issues.jboss.org/):"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-7055"
      },
      {
        "trust": 0.1,
        "url": "http://slackware.com"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3731"
      },
      {
        "trust": 0.1,
        "url": "http://osuosl.org)"
      },
      {
        "trust": 0.1,
        "url": "http://slackware.com/gpg-key"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2645"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3653"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10227"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3635"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3637"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3634"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3648"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2591"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2668"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3456"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3652"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10379"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10314"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10268"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3452"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2622"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/glsa/201802-04"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3329"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2590"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3649"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3450"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10283"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10286"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2647"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10294"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3651"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3647"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3462"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2583"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3309"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2612"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2703"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3308"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2640"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3636"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3461"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10276"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2696"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10378"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10384"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2562"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2665"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3453"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-2573"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3464"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3633"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3599"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-10155"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3641"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3600"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3463"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-3730"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2017-3732"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2017-3731"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2017-3730"
      },
      {
        "trust": 0.1,
        "url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2016-7055"
      },
      {
        "trust": 0.1,
        "url": "https://www.freebsd.org/handbook/makeworld.html\u003e."
      },
      {
        "trust": 0.1,
        "url": "https://security.freebsd.org/\u003e."
      },
      {
        "trust": 0.1,
        "url": "https://www.openssl.org/news/secadv/20170126.txt\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://security.freebsd.org/patches/sa-17:02/openssl-11.patch.asc"
      },
      {
        "trust": 0.1,
        "url": "https://security.freebsd.org/advisories/freebsd-sa-17:02.openssl.asc\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://security.freebsd.org/patches/sa-17:02/openssl-11.patch"
      },
      {
        "trust": 0.1,
        "url": "https://security.freebsd.org/patches/sa-17:02/openssl-10.patch"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3732\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3731\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://security.freebsd.org/patches/sa-17:02/openssl-10.patch.asc"
      },
      {
        "trust": 0.1,
        "url": "https://svnweb.freebsd.org/base?view=revision\u0026revision=nnnnnn\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-7055\u003e"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2017-3732"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      },
      {
        "db": "PACKETSTORM",
        "id": "169655"
      },
      {
        "db": "PACKETSTORM",
        "id": "169626"
      },
      {
        "db": "PACKETSTORM",
        "id": "148521"
      },
      {
        "db": "PACKETSTORM",
        "id": "148525"
      },
      {
        "db": "PACKETSTORM",
        "id": "141025"
      },
      {
        "db": "PACKETSTORM",
        "id": "146486"
      },
      {
        "db": "PACKETSTORM",
        "id": "141088"
      },
      {
        "db": "PACKETSTORM",
        "id": "141255"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-3732"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2017-3732"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      },
      {
        "db": "PACKETSTORM",
        "id": "169655"
      },
      {
        "db": "PACKETSTORM",
        "id": "169626"
      },
      {
        "db": "PACKETSTORM",
        "id": "148521"
      },
      {
        "db": "PACKETSTORM",
        "id": "148525"
      },
      {
        "db": "PACKETSTORM",
        "id": "141025"
      },
      {
        "db": "PACKETSTORM",
        "id": "146486"
      },
      {
        "db": "PACKETSTORM",
        "id": "141088"
      },
      {
        "db": "PACKETSTORM",
        "id": "141255"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-3732"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-05-04T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-3732"
      },
      {
        "date": "2017-05-18T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      },
      {
        "date": "2017-12-07T12:12:12",
        "db": "PACKETSTORM",
        "id": "169655"
      },
      {
        "date": "2018-03-27T12:12:12",
        "db": "PACKETSTORM",
        "id": "169626"
      },
      {
        "date": "2018-07-12T21:45:18",
        "db": "PACKETSTORM",
        "id": "148521"
      },
      {
        "date": "2018-07-12T21:48:57",
        "db": "PACKETSTORM",
        "id": "148525"
      },
      {
        "date": "2017-02-13T16:38:20",
        "db": "PACKETSTORM",
        "id": "141025"
      },
      {
        "date": "2018-02-20T14:04:53",
        "db": "PACKETSTORM",
        "id": "146486"
      },
      {
        "date": "2017-02-14T17:07:17",
        "db": "PACKETSTORM",
        "id": "141088"
      },
      {
        "date": "2017-02-23T17:14:20",
        "db": "PACKETSTORM",
        "id": "141255"
      },
      {
        "date": "2017-05-04T19:29:00.400000",
        "db": "NVD",
        "id": "CVE-2017-3732"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-08-29T00:00:00",
        "db": "VULMON",
        "id": "CVE-2017-3732"
      },
      {
        "date": "2018-02-07T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      },
      {
        "date": "2024-11-21T03:26:01.593000",
        "db": "NVD",
        "id": "CVE-2017-3732"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "148525"
      },
      {
        "db": "PACKETSTORM",
        "id": "146486"
      }
    ],
    "trust": 0.2
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "OpenSSL Service disruption in  (DoS) Vulnerabilities",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-003156"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "sql injection",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "148525"
      }
    ],
    "trust": 0.1
  }
}