CVE-2018-0732
Client DoS due to large DH parameter
CVE-2018-0732 is fixed in 5 products on 2 platforms, first by libssl1.0.0 1.0.2n-1ubuntu5.1, released June 12, 2018. 1 other affected product has no fix yet. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 2 platforms
CVSS
7.5
Low
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.4701
98th percentile
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 6 | 6.17.0 | Node.js 6 6.17.0 | Feb 28, 2019 |
| Linux | |||
| libssl1.0.0 · Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.1 | libssl1.0.0 1.0.2n-1ubuntu5.1 | Jun 12, 2018 |
| libssl1.1 · Ubuntu 18.04.6 LTS (bionic) | 1.1.0g-2ubuntu4.1 | libssl1.1 1.1.0g-2ubuntu4.1 | Jun 12, 2018 |
| openssl · Ubuntu 18.04.6 LTS (bionic) | 1.1.0g-2ubuntu4.1 | openssl 1.1.0g-2ubuntu4.1 | Jun 12, 2018 |
| openssl1.0 · Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.1 | openssl1.0 1.0.2n-1ubuntu5.1 | Jun 12, 2018 |
| No fix yet | |||
| Node.js 8 (Windows apps) | No fix yet | no-fix | n/a |