CVE-2018-0737

Исходное описание

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

Затронутое ПО

• OpenSSL ≥ 1.0.2b ≤ 1.0.2o≥ 1.1.0 ≤ 1.1.0h точное совпадение

Подробности

Опубликовано

2018-04-16

Последнее изменение

2026-10-15

Вектор CVSS

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-327

Ссылки

• cve.org/CVE-2018-0737
• nvd.nist.gov/vuln/detail/CVE-2018-0737
• www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
• www.securityfocus.com/bid/103766
• www.securitytracker.com/id/1040685
• access.redhat.com/errata/RHSA-2018:3221
• access.redhat.com/errata/RHSA-2018:3505
• access.redhat.com/errata/RHSA-2019:3932
• access.redhat.com/errata/RHSA-2019:3933
• access.redhat.com/errata/RHSA-2019:3935
• git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fd...
• git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e...
• lists.debian.org/debian-lts-announce/2018/07/msg00043.html
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E...