USN-3475-1: OpenSSL vulnerabilities
It was discovered that OpenSSL incorrectly parsed the IPAddressFamily extension in X.509 certificates, resulting in an erroneous display of the certificate in text format. (CVE-2017-3735) It was discovered that OpenSSL incorrectly performed the x8664 Montgomery squaring procedure. While unlikely, a remote attacker could possibly use this issue to recover private keys. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-3736)
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is CVE-2017-3735.
What is the severity of CVE-2017-3735?
The severity of CVE-2017-3735 is not specified in the advisory.
How does CVE-2017-3735 impact OpenSSL?
CVE-2017-3735 impacts OpenSSL by causing incorrect parsing of the IPAddressFamily extension in X.509 certificates, resulting in an erroneous display of the certificate in text format.
Which versions of libssl1.0.0 are affected by CVE-2017-3735?
Versions 1.0.2g-1ubuntu13.2, 1.0.2g-1ubuntu11.3, 1.0.2g-1ubuntu4.9, and 1.0.1f-1ubuntu2.23 of libssl1.0.0 are affected by CVE-2017-3735.
Is there a fix available for CVE-2017-3735?
Yes, there is a fix available for CVE-2017-3735. Update libssl1.0.0 to version 1.0.2g-1ubuntu13.2 or later, depending on your Ubuntu version.