- Vulnerability/
- USN-3475-1
USN-3475-1: OpenSSL vulnerabilities
First published: Mon Nov 06 2017(Updated: )
It was discovered that OpenSSL incorrectly parsed the IPAddressFamily extension in X.509 certificates, resulting in an erroneous display of the certificate in text format. (CVE-2017-3735) It was discovered that OpenSSL incorrectly performed the x86_64 Montgomery squaring procedure. While unlikely, a remote attacker could possibly use this issue to recover private keys. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-3736)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/libssl1.0.0 | <1.0.2g-1ubuntu13.2 | 1.0.2g-1ubuntu13.2 |
| =17.10 | ||
| All of | ||
| ubuntu/libssl1.0.0 | <1.0.2g-1ubuntu11.3 | 1.0.2g-1ubuntu11.3 |
| =17.04 | ||
| All of | ||
| ubuntu/libssl1.0.0 | <1.0.2g-1ubuntu4.9 | 1.0.2g-1ubuntu4.9 |
| =16.04 | ||
| All of | ||
| ubuntu/libssl1.0.0 | <1.0.1f-1ubuntu2.23 | 1.0.1f-1ubuntu2.23 |
| =14.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://ubuntu.com/security/CVE-2017-3735
- https://ubuntu.com/security/CVE-2017-3736
- https://ubuntu.com/security/notices/USN-3611-2
- https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu13.2
- https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu11.3
- https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.9
- https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.23
- https://ubuntu.com/security/notices/USN-3475-1 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is CVE-2017-3735.
What is the severity of CVE-2017-3735?
The severity of CVE-2017-3735 is not specified in the advisory.
How does CVE-2017-3735 impact OpenSSL?
CVE-2017-3735 impacts OpenSSL by causing incorrect parsing of the IPAddressFamily extension in X.509 certificates, resulting in an erroneous display of the certificate in text format.
Which versions of libssl1.0.0 are affected by CVE-2017-3735?
Versions 1.0.2g-1ubuntu13.2, 1.0.2g-1ubuntu11.3, 1.0.2g-1ubuntu4.9, and 1.0.1f-1ubuntu2.23 of libssl1.0.0 are affected by CVE-2017-3735.
Is there a fix available for CVE-2017-3735?
Yes, there is a fix available for CVE-2017-3735. Update libssl1.0.0 to version 1.0.2g-1ubuntu13.2 or later, depending on your Ubuntu version.
- agent/severity
- agent/references
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/usn
- source/Ubuntu
- anchor-related/USN-3611-2
- agent/software-canonical-lookup
- agent/title
- agent/tags
- agent/description
- agent/event
- agent/trending
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu ubuntu
- version/ubuntu ubuntu/17.10
- version/ubuntu ubuntu/17.04
- version/ubuntu ubuntu/16.04
- version/ubuntu ubuntu/14.04