https://seclists.org/oss-sec/2017/q1/52
Published Jan 10, 2017
·Updated
Affected Software
3 affected components
OpenSSL OpenSSL<1.0.1u
LibreSSL LibreSSL<6.0 errata 16, <5.9 errata 33
BoringSSL BoringSSL<November 2015
Frequently Asked Questions
1
What is the severity of CVE-2017-01-10?
CVE-2017-01-10 is considered to have a high severity due to its potential impact on cryptographic integrity.
2
How do I fix CVE-2017-01-10?
To fix CVE-2017-01-10, upgrade to OpenSSL version 1.0.1v or later, LibreSSL version 6.0 errata 16 or later, or BoringSSL versions released after November 2015.
3
What software is affected by CVE-2017-01-10?
CVE-2017-01-10 affects OpenSSL versions 1.0.1u and earlier, LibreSSL versions prior to 6.0 errata 16 and 5.9 errata 33, and BoringSSL versions released before November 2015.
4
What type of vulnerability is CVE-2017-01-10?
CVE-2017-01-10 is a cryptographic vulnerability that affects the signing function in specific versions of OpenSSL and its forks.
5
Is there a workaround for CVE-2017-01-10?
There is no definitive workaround for CVE-2017-01-10; updating to a patched version is the recommended course of action.