CVE-2017-3733: Encrypt-Then-Mac renegotiation crash
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3733?
CVE-2017-3733 is considered a high severity vulnerability due to the potential for OpenSSL to crash during a renegotiation handshake.
How do I fix CVE-2017-3733?
To fix CVE-2017-3733, upgrade OpenSSL to version 1.1.0e or later.
Which versions of OpenSSL are affected by CVE-2017-3733?
CVE-2017-3733 affects OpenSSL versions 1.1.0 through 1.1.0d.
What types of systems are impacted by CVE-2017-3733?
CVE-2017-3733 impacts both client and server systems that utilize the affected versions of OpenSSL.
What is the nature of the issue described in CVE-2017-3733?
CVE-2017-3733 involves a crash that can occur due to a mismatch in the Encrypt-Then-Mac extension during the renegotiation handshake.