漏洞信息详情
OpenSSL 信息泄露漏洞
- CNNVD编号：CNNVD-201702-216 <!--
- 危害等级： 中危-->
- 危害等级： 中危
- CVE编号： CVE-2017-3732
- 漏洞类型： 信息泄露
- 发布时间： 2017-01-26
- 威胁类型： 远程
- 更新时间： 2021-05-18
- 厂 商： openssl
- 漏洞来源： 该漏洞由OpenSSL官网披露。
-
漏洞简介
OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。
OpenSSL 1.0.2k之前的1.0.2版本和1.1.0d之前的1.1.0版本中存在信息泄露漏洞。该漏洞源于网络系统或产品在运行过程中存在配置等错误。未授权的攻击者可利用漏洞获取受影响组件敏感信息。
漏洞公告
目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接：
https://www.openssl.org/news/secadv/20170126.txt
参考网址
来源:MISC
链接:https://github.com/openssl/openssl/commit/a59b90bf491410f1f2bc4540cc21f1980fd14c5b
来源:SECTRACK
链接:http://www.securitytracker.com/id/1037717
来源:CONFIRM
链接:http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
来源:MISC
链接:https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
来源:FREEBSD
链接:https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc
来源:CONFIRM
链接:https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:2575
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:2187
来源:CONFIRM
链接:http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:2186
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:2185
来源:BID
链接:http://www.securityfocus.com/bid/95814
来源:CONFIRM
链接:http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:2713
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:2568
来源:CONFIRM
链接:https://www.tenable.com/security/tns-2017-04
来源:CONFIRM
链接:https://www.openssl.org/news/secadv/20170126.txt
来源:GENTOO
链接:https://security.gentoo.org/glsa/201702-07
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10715641
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10871356
来源:www-01.ibm.com
链接:https://www-01.ibm.com/support/docview.wss?uid=ibm10882734
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/76710
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2019.4325/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-affect-ibm-netezza-analytics-for-nps/
来源:www.ibm.com
链接:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-ibm-java-jre-8-0-1-1-affect-ibm-netezza-platform-software-clients/
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10882292
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/80494
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10882754
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/79678
来源:www.ibm.com
链接:https://www.ibm.com/support/pages/node/1106811
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10734877
来源:www.huawei.com
链接:https://www.huawei.com/cn/psirt/security-advisories/huawei-sa-20170503-01-openssl-cn
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/74714
受影响实体
- Openssl Openssl:1.0.2<!--2000-1-1-->
- Openssl Openssl:1.0.2:Beta1<!--2000-1-1-->
- Openssl Openssl:1.0.2:Beta2<!--2000-1-1-->
- Openssl Openssl:1.0.2:Beta3<!--2000-1-1-->
- Openssl Openssl:1.0.2a<!--2000-1-1-->
补丁
- OpenSSL 信息泄露漏洞的修复措施<!--2017-2-9-->
还没有评论，来说两句吧...