CVE-2018-5407
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
CVE-2018-5407 is fixed in 5 products on 2 platforms, first by libssl1.0.0 1.0.2n-1ubuntu5.2, released November 14, 2018. 2 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: Routine.
RoutineFixed on 2 platforms
CVSS
4.7
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0342
88th percentile
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Node.js 6 | 6.17.0 | Node.js 6 6.17.0 | Feb 28, 2019 |
| Linux | |||
| libssl1.0.0 · Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.2 | libssl1.0.0 1.0.2n-1ubuntu5.2 | Nov 14, 2018 |
| libssl1.1 · Ubuntu 18.04.6 LTS (bionic) | 1.1.0g-2ubuntu4.3 | libssl1.1 1.1.0g-2ubuntu4.3 | Nov 14, 2018 |
| openssl · Ubuntu 18.04.6 LTS (bionic) | 1.1.0g-2ubuntu4.3 | openssl 1.1.0g-2ubuntu4.3 | Nov 14, 2018 |
| openssl1.0 · Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.2 | openssl1.0 1.0.2n-1ubuntu5.2 | Nov 14, 2018 |
| No fix yet | |||
| Node.js 4 (Windows apps) | No fix yet | no-fix | n/a |
| Node.js 8 (Windows apps) | No fix yet | no-fix | n/a |