CVE-2017-3733
Fixed in a distro release EPSS 13%
During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.
Products: OpenSSL
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | openssl | 1.1.0e-1 |
| Debian:13 | openssl | 1.1.0e-1 |
| Debian:14 | openssl | 1.1.0e-1 |
| Ubuntu:14.04:LTS | openssl | 1.0.1f-1ubuntu2.22 |
| Ubuntu:16.04:LTS | openssl | 1.0.2g-1ubuntu4.6 |