CVE编号
CVE-2017-3735利用情况
暂无补丁情况
官方补丁披露时间
2017-08-29漏洞描述
在解析X.509证书中的IPAdressFamily扩展时，可以进行一个字节的覆盖。这将导致证书的文本显示不正确。此错误自2006年以来就存在，并且此后在所有版本的OpenSSL中都存在。解决建议
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载:https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc
参考链接 |
|
|---|---|
| http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html | |
| http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html | |
| http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html | |
| http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html | |
| http://www.securityfocus.com/bid/100515 | |
| http://www.securitytracker.com/id/1039726 | |
| https://access.redhat.com/errata/RHSA-2018:3221 | |
| https://access.redhat.com/errata/RHSA-2018:3505 | |
| https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822 | |
| https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html | |
| https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc | |
| https://security.gentoo.org/glsa/201712-03 | |
| https://security.netapp.com/advisory/ntap-20170927-0001/ | |
| https://security.netapp.com/advisory/ntap-20171107-0002/ | |
| https://support.apple.com/HT208331 | |
| https://usn.ubuntu.com/3611-2/ | |
| https://www.debian.org/security/2017/dsa-4017 | |
| https://www.debian.org/security/2017/dsa-4018 | |
| https://www.openssl.org/news/secadv/20170828.txt | |
| https://www.openssl.org/news/secadv/20171102.txt | |
| https://www.oracle.com//security-alerts/cpujul2021.html | |
| https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html | |
| https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html | |
| https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html | |
| https://www.tenable.com/security/tns-2017-14 | |
| https://www.tenable.com/security/tns-2017-15 |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.7j | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.7k | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.7l | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.7m | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8a | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8b | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8c | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8d | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8e | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8f | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8g | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8h | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8i | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8j | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8k | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8l | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8m | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8n | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8o | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8p | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8q | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8r | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8s | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8t | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8u | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8v | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8w | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8x | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8y | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8z | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8za | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8zb | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8zc | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8ze | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 0.9.8zg | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0a | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0b | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0c | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0d | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0e | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0f | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0g | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0h | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0i | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0j | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0k | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0l | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0m | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0n | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0o | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0p | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0q | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0r | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.0s | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1a | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1b | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1c | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1d | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1e | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1f | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1g | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1h | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1i | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1j | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1k | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.1l | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2a | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2b | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2c | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2d | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2e | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2f | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2h | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2i | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2j | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2k | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.0.2l | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.1.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.1.0a | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.1.0b | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.1.0c | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.1.0d | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.1.0e | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | 1.1.0f | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.3 | openssl | * |
Up to (excluding) 1.0.2m-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.4 | openssl | * |
Up to (excluding) 1.0.2m-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.5 | openssl | * |
Up to (excluding) 1.0.2m-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.6 | openssl | * |
Up to (excluding) 1.0.2m-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.7 | openssl | * |
Up to (excluding) 1.0.2m-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.8 | openssl | * |
Up to (excluding) 1.0.2m-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | openssl | * |
Up to (excluding) 1.0.2k-16.amzn2.0.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | openssl | * |
Up to (excluding) 1.0.2k-16.146.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_7 | openssl | * |
Up to (excluding) 1.0.1t-1+deb7u3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_8 | openssl | * |
Up to (excluding) 1.0.1t-1+deb8u8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | openssl | * |
Up to (excluding) 1.1.0f-3+deb9u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_25 | openssl | * |
Up to (excluding) 1.0.2m-1.fc25 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_26 | openssl | * |
Up to (excluding) 1.0.2m-1.fc26 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_27 | openssl | * |
Up to (excluding) 1.0.2m-1.fc27 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | openssl | * |
Up to (excluding) 4.8.7-11.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.3 | openssl | * |
Up to (excluding) 6.12.2-6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_6 | openssl | * |
Up to (excluding) 1.0.1e-57.0.3.el6 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | openssl | * |
Up to (excluding) 1.0.2k-16.0.1.ksplice1.el7_6.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP2 | openssl | * |
Up to (excluding) 1.0.2j-60.16.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP3 | openssl | * |
Up to (excluding) 1.0.2j-60.16.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_14.04 | openssl | * |
Up to (excluding) 1.0.1f-1ubuntu2.23 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04 | openssl | * |
Up to (excluding) 1.0.2g-1ubuntu4.9 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | openssl | * |
Up to (excluding) 1.0.2g-1ubuntu14 |
|||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...