Unrated
Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. T...
CVE-2018-0733
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2018-0733 openssl Fixed in: 1.0.2o-r0
- Debian DEBIAN-CVE-2018-0733 openssl Fixed in: 1.1.0h-1
Original description The description as published by the source.
Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).
References
- advisory oracle.com
- advisory oracle.com
- advisory securityfocus.com
- advisory securitytracker.com
- advisory security.gentoo.org
- advisory security.netapp.com
- advisory openssl.org
- advisory oracle.com
- advisory oracle.com
- advisory oracle.com
- web git.openssl.org
- web tenable.com
- web tenable.com
- web tenable.com