CVE-2017-3736: Infoleak
First published: Thu Nov 02 2017(Updated: )
Last updated 24 July 2024
Credit: openssl-security@openssl.org openssl-security@openssl.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jbcs-httpd24-apache-commons-daemon | <0:1.1.0-1.redhat_2.1.jbcs.el6 | 0:1.1.0-1.redhat_2.1.jbcs.el6 |
| redhat/jbcs-httpd24-apache-commons-daemon-jsvc | <1:1.1.0-1.redhat_2.jbcs.el6 | 1:1.1.0-1.redhat_2.jbcs.el6 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-14.jbcs.el6 | 0:1.6.3-14.jbcs.el6 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-9.jbcs.el6 | 0:1.6.1-9.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.29-17.jbcs.el6 | 0:2.4.29-17.jbcs.el6 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.29.0-8.jbcs.el6 | 0:1.29.0-8.jbcs.el6 |
| redhat/jbcs-httpd24-openssl | <1:1.0.2n-11.jbcs.el6 | 1:1.0.2n-11.jbcs.el6 |
| redhat/jbcs-httpd24-apache-commons-daemon | <0:1.1.0-1.redhat_2.1.jbcs.el7 | 0:1.1.0-1.redhat_2.1.jbcs.el7 |
| redhat/jbcs-httpd24-apache-commons-daemon-jsvc | <1:1.1.0-1.redhat_2.jbcs.el7 | 1:1.1.0-1.redhat_2.jbcs.el7 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-14.jbcs.el7 | 0:1.6.3-14.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-9.jbcs.el7 | 0:1.6.1-9.jbcs.el7 |
| redhat/jbcs-httpd24-httpd | <0:2.4.29-17.jbcs.el7 | 0:2.4.29-17.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.29.0-8.jbcs.el7 | 0:1.29.0-8.jbcs.el7 |
| redhat/jbcs-httpd24-openssl | <1:1.0.2n-11.jbcs.el7 | 1:1.0.2n-11.jbcs.el7 |
| redhat/java | <1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el6_10 | 1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el6_10 |
| redhat/openssl | <1:1.0.2k-12.el7 | 1:1.0.2k-12.el7 |
| redhat/java | <1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el7 | 1.8.0-ibm-1:1.8.0.5.20-1jpp.1.el7 |
| OpenSSL OpenSSL | >=1.0.2<1.0.2m | |
| OpenSSL OpenSSL | >=1.1.0<1.1.0g | |
| redhat/openssl | <1.1.0 | 1.1.0 |
| redhat/openssl | <1.0.2 | 1.0.2 |
| IBM Security Verify Governance | <=10.0 | |
| debian/openssl | 1.1.1w-0+deb11u1 1.1.1n-0+deb11u5 3.0.14-1~deb12u1 3.0.14-1~deb12u2 3.3.2-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2017-3736 https://nvd.nist.gov/vuln/detail/CVE-2017-3736 https://www.openssl.org/news/secadv/20171102.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=1509169
- https://access.redhat.com/errata/RHSA-2018:2186
- https://access.redhat.com/errata/RHSA-2018:2185
- https://access.redhat.com/errata/RHSA-2018:2575
- https://access.redhat.com/errata/RHSA-2018:0998
- https://access.redhat.com/errata/RHSA-2018:2568
- https://access.redhat.com/errata/RHSA-2018:2187
- https://access.redhat.com/errata/RHSA-2018:2713
- https://access.redhat.com/security/cve/CVE-2017-3736
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- http://www.securityfocus.com/bid/101666
- http://www.securitytracker.com/id/1039727
- https://github.com/openssl/openssl/commit/4443cf7aa0099e5ce615c18cee249fff77fb0871
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc
- https://security.gentoo.org/glsa/201712-03
- https://security.netapp.com/advisory/ntap-20171107-0002/
- https://security.netapp.com/advisory/ntap-20180117-0002/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03881en_us
- https://www.debian.org/security/2017/dsa-4017
- https://www.debian.org/security/2017/dsa-4018
- https://www.openssl.org/news/secadv/20171102.txt
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.tenable.com/security/tns-2017-14
- https://www.tenable.com/security/tns-2017-15
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03881en_us
- https://launchpad.net/bugs/cve/CVE-2017-3736
- https://access.redhat.com/security/cve/CVE-2017-3732
- https://access.redhat.com/security/cve/CVE-2015-3193
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1486147
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1486146
- https://github.com/openssl/openssl/commit/668a709a8d7ea374ee72ad2d43ac72ec60a80eee
- https://exchange.xforce.ibmcloud.com/vulnerabilities/134397
- https://www.ibm.com/support/pages/node/7057377 (Advisory)
- https://git.openssl.org/?p=openssl.git;a=commit;h=38d600147331d36e74174ebbd4008b63188b321b
- https://git.openssl.org/?p=openssl.git;a=commit;h=4443cf7aa0099e5ce615c18cee249fff77fb0871
- https://security-tracker.debian.org/tracker/CVE-2017-3736
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3736
- https://nvd.nist.gov/vuln/detail/CVE-2017-3736
- https://ubuntu.com/security/CVE-2017-3736
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the severity of CVE-2017-3736?
The severity of CVE-2017-3736 is medium with a severity value of 6.5.
How does CVE-2017-3736 affect OpenSSL?
CVE-2017-3736 affects OpenSSL versions before 1.0.2m and 1.1.0 before 1.1.0g on the x86_64 architecture.
Are RSA and DSA algorithms affected by CVE-2017-3736?
No, RSA and DSA algorithms are not affected by CVE-2017-3736.
Is it difficult to perform attacks against RSA and DSA as a result of CVE-2017-3736?
Yes, attacks against RSA and DSA as a result of CVE-2017-3736 are believed to be very difficult to perform and unlikely.
How can I fix CVE-2017-3736?
To fix CVE-2017-3736, update OpenSSL to version 1.0.2m or higher, or version 1.1.0g or higher.
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-3736
- collector/ibm-support
- source/IBM
- collector/security-tracker-debian
- source/Debian
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/references
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- agent/trending
- package-manager/redhat
- vendor/openssl
- canonical/openssl openssl
- version/openssl openssl/1.0.2
- version/openssl openssl/1.1.0
- vendor/ibm
- canonical/ibm security verify governance
- version/ibm security verify governance/10.0
- package-manager/debian