CLD-8 Details

Other IDs this deficiency may be known by:

CVE ID CVE-2017-3735 (nvd) (mitre) (debian) (archlinux) (red hat) (suse) (ubuntu)
Other ID(s)

Basic Information:

Affected Package(s) openssl
Deficiency Type SECURITY
Date Created 2017-09-05 10:14:57
Date Last Modified 2017-11-02 21:50:59

Version Specific Information:

Cucumber 1.0 i686 fixed in openssl-1.0.2m-i686-1
Cucumber 1.0 x86_64 fixed in openssl-1.0.2m-x86_64-1 and openssl-lib_i686-1.0.2m-lib_i686-1

Cucumber 1.1 i686 fixed in openssl-1.0.2m-i686-1
Cucumber 1.1 x86_64 fixed in openssl-1.0.2m-x86_64-1 and openssl-lib_i686-1.0.2m-lib_i686-1

Details:

While parsing an IPAdressFamily extension in an X.509 certificate, it is
possible to do a one-byte overread. This would result in an incorrect text
display of the certificate. This bug has been present since 2006 and is present
in all versions of OpenSSL since then
(https://nvd.nist.gov/vuln/detail/CVE-2017-3735).

Note that the OpenSSL developers consider this a "low severity fix" and are
therefore not pushing out the patch until the next release of OpenSSL :/
(https://www.openssl.org/news/secadv/20170828.txt).

Maybe it's time we considered switching to LibreSSL.