CVE-2018-0734
First published: Tue Oct 16 2018(Updated: )
A flaw was found in OpenSSL versions from 1.1.0 through 1.1.0i inclusive, from 1.0.2 through 1.0.2p inclusive and version 1.1.1. The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Reference: <a href="https://www.openssl.org/news/secadv/20181030.txt">https://www.openssl.org/news/secadv/20181030.txt</a> Upstream Patches: <a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=43e6a58d4991a451daf4891ff05a48735df871ac">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=43e6a58d4991a451daf4891ff05a48735df871ac</a> <a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f</a> <a href="https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7">https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7</a> <a href="https://github.com/openssl/openssl/commit/b96bebacfe814deb99fb64a3ed2296d95c573600">https://github.com/openssl/openssl/commit/b96bebacfe814deb99fb64a3ed2296d95c573600</a>
Credit: openssl-security@openssl.org openssl-security@openssl.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jbcs-httpd24-apr | <0:1.6.3-63.jbcs.el6 | 0:1.6.3-63.jbcs.el6 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-48.jbcs.el6 | 0:1.6.1-48.jbcs.el6 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-7.jbcs.el6 | 0:1.0.6-7.jbcs.el6 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-14.jbcs.el6 | 0:7.64.1-14.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-33.jbcs.el6 | 0:2.4.37-33.jbcs.el6 |
| redhat/jbcs-httpd24-jansson | <0:2.11-20.jbcs.el6 | 0:2.11-20.jbcs.el6 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-4.jbcs.el6 | 0:1.39.2-4.jbcs.el6 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1-25.jbcs.el6 | 1:1.1.1-25.jbcs.el6 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-63.jbcs.el7 | 0:1.6.3-63.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-48.jbcs.el7 | 0:1.6.1-48.jbcs.el7 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-7.jbcs.el7 | 0:1.0.6-7.jbcs.el7 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-14.jbcs.el7 | 0:7.64.1-14.jbcs.el7 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-33.jbcs.el7 | 0:2.4.37-33.jbcs.el7 |
| redhat/jbcs-httpd24-jansson | <0:2.11-20.jbcs.el7 | 0:2.11-20.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-4.jbcs.el7 | 0:1.39.2-4.jbcs.el7 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1-25.jbcs.el7 | 1:1.1.1-25.jbcs.el7 |
| redhat/openssl | <1:1.0.2k-19.el7 | 1:1.0.2k-19.el7 |
| redhat/openssl | <1:1.1.1c-2.el8 | 1:1.1.1c-2.el8 |
| IBM Security Verify Governance | <=10.0 | |
| ubuntu/openssl | <1.0.1 | 1.0.1 |
| ubuntu/openssl | <1.1.1 | 1.1.1 |
| ubuntu/openssl | <1.1.0 | 1.1.0 |
| ubuntu/openssl | <1.1.1-1ubuntu2.1 | 1.1.1-1ubuntu2.1 |
| ubuntu/openssl | <1.1.1 | 1.1.1 |
| ubuntu/openssl | <1.1.1 | 1.1.1 |
| ubuntu/openssl | <1.1.1 | 1.1.1 |
| ubuntu/openssl | <1.1.1 | 1.1.1 |
| ubuntu/openssl | <1.0.2 | 1.0.2 |
| ubuntu/openssl1.0 | <1.0.2 | 1.0.2 |
| ubuntu/openssl1.0 | <1.0.2 | 1.0.2 |
| redhat/openssl | <1.1.0 | 1.1.0 |
| redhat/openssl | <1.1.1 | 1.1.1 |
| redhat/openssl | <1.0.2 | 1.0.2 |
| debian/openssl | 1.1.1n-0+deb10u3 1.1.1n-0+deb10u6 1.1.1w-0+deb11u1 1.1.1n-0+deb11u5 3.0.11-1~deb12u2 3.1.5-1 | |
| OpenSSL OpenSSL | >=1.0.2<=1.0.2p | |
| OpenSSL OpenSSL | >=1.1.0<=1.1.0i | |
| OpenSSL OpenSSL | =1.1.1 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =18.10 | |
| Debian Debian Linux | =9.0 | |
| Nodejs Node.js | >=6.0.0<=6.8.1 | |
| Nodejs Node.js | >=6.9.0<6.15.0 | |
| Nodejs Node.js | >=8.0.0<=8.8.1 | |
| Nodejs Node.js | >=8.9.0<8.14.0 | |
| Nodejs Node.js | >=10.0.0<=10.12.0 | |
| Nodejs Node.js | >=11.0.0<11.3.0 | |
| Nodejs Node.js | =10.13.0 | |
| Netapp Cn1610 Firmware | ||
| Netapp Cn1610 | ||
| Netapp Cloud Backup | ||
| Netapp Oncommand Unified Manager | ||
| Netapp Santricity Smi-s Provider | ||
| Netapp Snapcenter | ||
| Netapp Steelstore | ||
| Netapp Storage Automation Store | ||
| Oracle API Gateway | =11.1.2.4.0 | |
| Oracle E-business Suite Technology Stack | =0.9.8 | |
| Oracle E-business Suite Technology Stack | =1.0.0 | |
| Oracle E-business Suite Technology Stack | =1.0.1 | |
| Oracle Enterprise Manager Base Platform | =12.1.0.5.0 | |
| Oracle Enterprise Manager Base Platform | =13.2.0.0.0 | |
| Oracle Enterprise Manager Base Platform | =13.3.0.0.0 | |
| Oracle Enterprise Manager Ops Center | =12.3.3 | |
| Oracle Mysql Enterprise Backup | >=3.0<=3.12.3 | |
| Oracle Mysql Enterprise Backup | >=4.0<=4.1.2 | |
| Oracle PeopleSoft Enterprise PeopleTools | =8.55 | |
| Oracle PeopleSoft Enterprise PeopleTools | =8.56 | |
| Oracle PeopleSoft Enterprise PeopleTools | =8.57 | |
| Oracle Primavera P6 Professional Project Management | >=17.7<=17.12 | |
| Oracle Primavera P6 Professional Project Management | =8.4 | |
| Oracle Primavera P6 Professional Project Management | =15.1 | |
| Oracle Primavera P6 Professional Project Management | =15.2 | |
| Oracle Primavera P6 Professional Project Management | =16.1 | |
| Oracle Primavera P6 Professional Project Management | =16.2 | |
| Oracle Primavera P6 Professional Project Management | =18.8 | |
| Oracle Tuxedo | =12.1.1.0.0 | |
| All of | ||
| Netapp Cn1610 Firmware | ||
| Netapp Cn1610 |
Remedy
https://git.openssl.org/?p=openssl.git;a=commit;h=43e6a58d4991a451daf4891ff05a48735df871ac (1.0.2)
Remedy
https://git.openssl.org/?p=openssl.git;a=commit;h=ebf65dbe1a67682d7e1f58db9c53ef737fb37f32 (1.0.2)
Remedy
https://git.openssl.org/?p=openssl.git;a=commit;h=880d1c76ed9916cddb97fe05fb4c144f0f6f1012 (1.0.2)
Remedy
https://git.openssl.org/?p=openssl.git;a=commit;h=f1b12b8713a739f27d74e6911580b2e70aea2fa4 (1.1.1)
Remedy
https://git.openssl.org/?p=openssl.git;a=commit;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f (1.1.1)
Remedy
https://git.openssl.org/?p=openssl.git;a=commit;h=6039651c43944cf4633483a74c2ef3a6b8c0c6c0 (1.1.1)
Remedy
https://git.openssl.org/?p=openssl.git;a=commit;h=84862c0979737b591acb689aef41ae2644176f32 (1.1.0)
Remedy
https://git.openssl.org/?p=openssl.git;a=commit;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7 (1.1.0)
Remedy
https://git.openssl.org/?p=openssl.git;a=commit;h=26d7fce13d469f8d1a1b42131467ed4a65f8137b (1.1.0)
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://exchange.xforce.ibmcloud.com/vulnerabilities/152085
- https://www.ibm.com/support/pages/node/7057377 (Advisory)
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=43e6a58d4991a451daf4891ff05a48735df871ac
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7
- https://www.openssl.org/news/secadv/20181030.txt
- http://www.securityfocus.com/bid/105758
- https://security.netapp.com/advisory/ntap-20181105-0002/
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
- https://www.debian.org/security/2018/dsa-4348
- https://usn.ubuntu.com/3840-1/
- https://www.debian.org/security/2018/dsa-4355
- https://www.tenable.com/security/tns-2018-16
- https://www.tenable.com/security/tns-2018-17
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://security.netapp.com/advisory/ntap-20190118-0002/
- https://security.netapp.com/advisory/ntap-20190423-0002/
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html
- https://access.redhat.com/errata/RHSA-2019:2304
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/
- https://access.redhat.com/errata/RHSA-2019:3700
- https://access.redhat.com/errata/RHSA-2019:3932
- https://access.redhat.com/errata/RHSA-2019:3933
- https://access.redhat.com/errata/RHSA-2019:3935
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://launchpad.net/bugs/cve/CVE-2018-0734
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/
- https://github.com/openssl/openssl/commit/b96bebacfe814deb99fb64a3ed2296d95c573600
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1644370
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1644368
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1644366
- https://access.redhat.com/security/cve/cve-2018-0734
- https://bugzilla.redhat.com/show_bug.cgi?id=1644364
- https://www.cve.org/CVERecord?id=CVE-2018-0734 https://nvd.nist.gov/vuln/detail/CVE-2018-0734
- https://access.redhat.com/errata/RHBA-2020:0547
- https://git.openssl.org/?p=openssl.git;a=commit;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f
- https://git.openssl.org/?p=openssl.git;a=commit;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7
- https://git.openssl.org/?p=openssl.git;a=commit;h=43e6a58d4991a451daf4891ff05a48735df871ac
- https://git.openssl.org/?p=openssl.git;a=commitdiff;h=b96bebacfe814deb99fb64a3ed2296d95c573600
- https://security-tracker.debian.org/tracker/CVE-2018-0734
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0734
- https://ubuntu.com/security/notices/USN-3840-1
- https://nvd.nist.gov/vuln/detail/CVE-2018-0734
- https://git.openssl.org/?p=openssl.git;a=commit;h=43e6a58d4991a451daf4891ff05a48735df871ac (1.0.2)
- https://git.openssl.org/?p=openssl.git;a=commit;h=ebf65dbe1a67682d7e1f58db9c53ef737fb37f32 (1.0.2)
- https://git.openssl.org/?p=openssl.git;a=commit;h=880d1c76ed9916cddb97fe05fb4c144f0f6f1012 (1.0.2)
- https://git.openssl.org/?p=openssl.git;a=commit;h=f1b12b8713a739f27d74e6911580b2e70aea2fa4 (1.1.1)
- https://git.openssl.org/?p=openssl.git;a=commit;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f (1.1.1)
- https://git.openssl.org/?p=openssl.git;a=commit;h=6039651c43944cf4633483a74c2ef3a6b8c0c6c0 (1.1.1)
- https://git.openssl.org/?p=openssl.git;a=commit;h=84862c0979737b591acb689aef41ae2644176f32 (1.1.0)
- https://git.openssl.org/?p=openssl.git;a=commit;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7 (1.1.0)
- https://git.openssl.org/?p=openssl.git;a=commit;h=26d7fce13d469f8d1a1b42131467ed4a65f8137b (1.1.0)
- https://ubuntu.com/security/CVE-2018-0734
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- collector/ibm-support
- agent/last-modified-date
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/type
- agent/author
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-0734
- agent/severity
- agent/remedy
- agent/references
- agent/description
- agent/weakness
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/redhat
- vendor/ibm
- canonical/ibm security verify governance
- version/ibm security verify governance/10.0
- package-manager/ubuntu
- package-manager/debian
- vendor/openssl
- canonical/openssl openssl
- version/openssl openssl/1.0.2
- version/openssl openssl/1.0.2p
- version/openssl openssl/1.1.0
- version/openssl openssl/1.1.0i
- version/openssl openssl/1.1.1
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/18.10
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/nodejs
- canonical/nodejs node.js
- version/nodejs node.js/6.0.0
- version/nodejs node.js/6.8.1
- version/nodejs node.js/6.9.0
- version/nodejs node.js/8.0.0
- version/nodejs node.js/8.8.1
- version/nodejs node.js/8.9.0
- version/nodejs node.js/10.0.0
- version/nodejs node.js/10.12.0
- version/nodejs node.js/11.0.0
- version/nodejs node.js/10.13.0
- vendor/netapp
- canonical/netapp cn1610 firmware
- canonical/netapp cn1610
- canonical/netapp cloud backup
- canonical/netapp oncommand unified manager
- canonical/netapp santricity smi-s provider
- canonical/netapp snapcenter
- canonical/netapp steelstore
- canonical/netapp storage automation store
- vendor/oracle
- canonical/oracle api gateway
- version/oracle api gateway/11.1.2.4.0
- canonical/oracle e-business suite technology stack
- version/oracle e-business suite technology stack/0.9.8
- version/oracle e-business suite technology stack/1.0.0
- version/oracle e-business suite technology stack/1.0.1
- canonical/oracle enterprise manager base platform
- version/oracle enterprise manager base platform/12.1.0.5.0
- version/oracle enterprise manager base platform/13.2.0.0.0
- version/oracle enterprise manager base platform/13.3.0.0.0
- canonical/oracle enterprise manager ops center
- version/oracle enterprise manager ops center/12.3.3
- canonical/oracle mysql enterprise backup
- version/oracle mysql enterprise backup/3.0
- version/oracle mysql enterprise backup/3.12.3
- version/oracle mysql enterprise backup/4.0
- version/oracle mysql enterprise backup/4.1.2
- canonical/oracle peoplesoft enterprise peopletools
- version/oracle peoplesoft enterprise peopletools/8.55
- version/oracle peoplesoft enterprise peopletools/8.56
- version/oracle peoplesoft enterprise peopletools/8.57
- canonical/oracle primavera p6 professional project management
- version/oracle primavera p6 professional project management/17.7
- version/oracle primavera p6 professional project management/17.12
- version/oracle primavera p6 professional project management/8.4
- version/oracle primavera p6 professional project management/15.1
- version/oracle primavera p6 professional project management/15.2
- version/oracle primavera p6 professional project management/16.1
- version/oracle primavera p6 professional project management/16.2
- version/oracle primavera p6 professional project management/18.8
- canonical/oracle tuxedo
- version/oracle tuxedo/12.1.1.0.0