Non évaluée
Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. T...
CVE-2018-0733
Première détection SecPulse
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2018-0733 openssl Corrigé dans: 1.0.2o-r0
- Debian DEBIAN-CVE-2018-0733 openssl Corrigé dans: 1.1.0h-1
Description d'origine La description telle que publiée par la source (souvent en anglais).
Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).
Références
- advisory oracle.com
- advisory oracle.com
- advisory securityfocus.com
- advisory securitytracker.com
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory openssl.org
- advisory oracle.com
- advisory oracle.com
- advisory oracle.com
- web git.openssl.org
- web tenable.com
- web tenable.com
- web tenable.com