漏洞信息详情
OpenSSL 信息泄露漏洞
- CNNVD编号：CNNVD-201712-216
- 危害等级： 中危
- CVE编号： CVE-2017-3738
- 漏洞类型： 信息泄露
- 发布时间： 2017-12-08
- 威胁类型： 远程
- 更新时间： 2022-08-22
- 厂 商： openssl
- 漏洞来源：
漏洞简介
OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。
OpenSSL 1.0.2版本至1.0.2m版本和1.1.0版本至1.1.0g版本中的AVX2 Montgomery乘法运算存在信息泄露漏洞。该漏洞源于网络系统或产品在运行过程中存在配置等错误。未授权的攻击者可利用漏洞获取受影响组件敏感信息。
漏洞公告
目前厂商已发布升级补丁以修复漏洞，补丁获取链接：
https://www.openssl.org/news/secadv/20171207.txt
参考网址
来源:CONFIRM
链接:https://www.openssl.org/news/secadv/20171207.txt
来源:SECTRACK
链接:http://www.securitytracker.com/id/1039978
来源:MISC
链接:https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.HTML
来源:CONFIRM
链接:http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.HTML
来源:DEBIAN
链接:https://www.debian.org/security/2018/dsa-4157
来源:CONFIRM
链接:https://www.tenable.com/security/tns-2018-07
来源:CONFIRM
链接:https://www.tenable.com/security/tns-2017-16
来源:CONFIRM
链接:https://www.tenable.com/security/tns-2018-06
来源:CONFIRM
链接:https://www.tenable.com/security/tns-2018-04
来源:CONFIRM
链接:https://www.openssl.org/news/secadv/20180327.txt
来源:MISC
链接:https://github.com/openssl/openssl/commit/e502cc86df9dafded1694fceb3228ee34d11c11a
来源:BID
链接:https://www.securityfocus.com/bid/102118
来源:CONFIRM
链接:http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.HTML
来源:MISC
链接:https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.HTML
来源:FREEBSD
链接:https://security.FreeBSD.org/advisories/FreeBSD-SA-17:12.openssl.asc
来源:BID
链接:http://www.securityfocus.com/bid/102118
来源:CONFIRM
链接:https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03881en_us
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:2187
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:2186
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:2185
来源:GENTOO
链接:https://security.gentoo.org/glsa/201712-03
来源:REDHAT
链接:https://access.redhat.com/errata/RHSA-2018:0998
来源:DEBIAN
链接:https://www.debian.org/security/2017/dsa-4065
来源:CONFIRM
链接:https://nodejs.org/en/blog/vulnerability/december-2017-security-releases/
来源:CONFIRM
链接:https://security.netapp.com/advisory/ntap-20171208-0001/
来源:CONFIRM
链接:http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.HTML
来源:CONFIRM
链接:http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.HTML
来源:CONFIRM
链接:https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.HTML
来源:www.suse.com
链接:https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1.HTML
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10887987
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10887995
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10887989
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10887985
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10887991
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2022.0696
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2019.2261/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2019.2536/
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/ESB-2019.4645/
来源:www-01.ibm.com
链接:https://www-01.ibm.com/support/docview.wss?uid=ibm10887987
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10879093
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/78218
来源:www.auscert.org.au
链接:https://www.auscert.org.au/bulletins/78082
来源:www.ibm.com
链接:http://www.ibm.com/support/docview.wss?uid=ibm10888295
受影响实体
- Openssl Openssl:1.0.2
- Openssl Openssl:1.0.2:Beta1
- Openssl Openssl:1.0.2:Beta2
- Openssl Openssl:1.0.2:Beta3
- Openssl Openssl:1.0.2a
补丁
- OpenSSL 安全漏洞的修复措施
评论