CVE-2017-3731: Truncated packet could crash via OOB read

Q: What is the severity of CVE-2017-3731?

CVE-2017-3731 has been rated as high severity due to its potential to cause a denial of service through a crash.

Q: How do I fix CVE-2017-3731?

To remediate CVE-2017-3731, upgrade your OpenSSL to a version that is not affected, such as 1.0.2k or later.

Q: Which versions of OpenSSL are affected by CVE-2017-3731?

CVE-2017-3731 affects OpenSSL versions 1.0.2 and 1.1.0 before certain fixes.

Q: What impact does CVE-2017-3731 have on OpenSSL users?

Users of OpenSSL affected by CVE-2017-3731 may experience application crashes under specific conditions when using certain ciphers.

Q: Is CVE-2017-3731 specific to any operating system?

CVE-2017-3731 can affect any system running vulnerable versions of OpenSSL, not limited to a specific operating system.

Published Jan 26, 2017

Updated

For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k

External References:

https://www.openssl.org/news/secadv/20170126.txt

Other sources

If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.

— Launchpad

This is a moderate severity flaw in OpenSSL. By default, Node.js disables RC4 so most users are not affected. As RC4 can be enabled programmatically, it is possible for a Node.js developer to craft code that may be vulnerable to this flaw. Any user activating RC4 in their codebase should prioritise this update.

All active versions of Node.js are affected, but the severity is very low for most users.

— Node.Js

Affected Software

26 affected componentsFixes available

debian/openssl

1.1.1w-0+deb11u11.1.1w-0+deb11u23.0.15-1~deb12u13.0.14-1~deb12u23.5.0-1

OpenSSL OpenSSL=1.1.0a

OpenSSL OpenSSL=1.1.0b

OpenSSL OpenSSL=1.1.0c

OpenSSL OpenSSL=1.0.2

OpenSSL OpenSSL=1.0.2-beta1

OpenSSL OpenSSL=1.0.2-beta2

OpenSSL OpenSSL=1.0.2-beta3

OpenSSL OpenSSL=1.0.2a

OpenSSL OpenSSL=1.0.2b

OpenSSL OpenSSL=1.0.2c

OpenSSL OpenSSL=1.0.2d

OpenSSL OpenSSL=1.0.2e

OpenSSL OpenSSL=1.0.2f

OpenSSL OpenSSL=1.0.2h

OpenSSL OpenSSL=1.0.2i

OpenSSL OpenSSL=1.0.2j

Nodejs Node.js>=4.0.0<=4.1.2

Nodejs Node.js>=4.2.0<4.7.3

Nodejs Node.js>=5.0.0<=5.12.0

Nodejs Node.js>=6.0.0<=6.8.1

Nodejs Node.js>=6.9.0<6.9.5

Nodejs Node.js>=7.0.0<7.5.0

redhat/openssl<1.0.2

1.0.2

redhat/openssl<1.1.0

1.1.0

Node.js Node.js>=4.0.0<4.7.3, >=5.0.0<6.0.0, >=6.0.0<6.9.5, >=7.0.0<7.5.0

4.7.36.9.57.5.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/openssl to a version that resolves this vulnerability.
Fixed in 1.1.1w-0+deb11u1Fixed in 1.1.1w-0+deb11u2Fixed in 3.0.15-1~deb12u1Fixed in 3.0.14-1~deb12u2Fixed in 3.5.0-1
Upgrade
Upgrade redhat/openssl to a version that resolves this vulnerability.
Fixed in 1.0.2
Upgrade
Upgrade redhat/openssl to a version that resolves this vulnerability.
Fixed in 1.1.0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.7.3Fixed in 6.9.5Fixed in 7.5.0
Upgrade
Upgrade OpenSSL to a version that resolves this vulnerability.
Fixed in 1.1.0d
Upgrade
Upgrade OpenSSL to a version that resolves this vulnerability.
Fixed in 1.0.2k

Event History

Jan 26, 2017

Data Sourced

via Red Hat·03:35 PM

DescriptionSeverityAffected Software

May 4, 2017

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

nodejs-openssl-january-2017

Frequently Asked Questions

What is the severity of CVE-2017-3731?