CVE-2018-0735
Fixed in a distro release EPSS 5%
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).
Products: OpenSSL
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | nodejs | 10.14.0-r0 |
| Alpine 3.10 | openssl | 1.1.1a-r0 |
| Alpine 3.11 | nodejs | 10.14.0-r0 |
| Alpine 3.11 | openssl | 1.1.1a-r0 |
| Alpine 3.12 | nodejs | 10.14.0-r0 |
| Alpine 3.12 | openssl | 1.1.1a-r0 |
| Alpine 3.13 | nodejs | 10.14.0-r0 |
| Alpine 3.13 | openssl | 1.1.1a-r0 |
| Alpine 3.14 | nodejs | 10.14.0-r0 |
| Alpine 3.14 | openssl | 1.1.1a-r0 |
| Alpine 3.15 | nodejs | 10.14.0-r0 |
| Alpine 3.15 | openssl | 1.1.1a-r0 |
| Alpine 3.15 | openssl3 | 1.1.1a-r0 |
| Alpine 3.16 | nodejs | 10.14.0-r0 |
| Alpine 3.16 | openssl | 1.1.1a-r0 |
| Alpine 3.16 | openssl3 | 1.1.1a-r0 |
| Alpine 3.17 | nodejs | 10.14.0-r0 |
| Alpine 3.17 | openssl | 1.1.1a-r0 |
| Alpine 3.18 | nodejs | 10.14.0-r0 |
| Alpine 3.18 | openssl | 1.1.1a-r0 |
| Alpine 3.19 | nodejs | 10.14.0-r0 |
| Alpine 3.19 | openssl | 1.1.1a-r0 |
| Alpine 3.20 | nodejs | 10.14.0-r0 |
| Alpine 3.20 | openssl | 1.1.1a-r0 |
| Alpine 3.21 | nodejs | 10.14.0-r0 |
| Alpine 3.21 | openssl | 1.1.1a-r0 |
| Alpine 3.22 | nodejs | 10.14.0-r0 |
| Alpine 3.22 | openssl | 1.1.1a-r0 |
| Alpine 3.23 | nodejs | 10.14.0-r0 |
| Alpine 3.23 | openssl | 1.1.1a-r0 |
| Alpine 3.24 | nodejs | 10.14.0-r0 |
| Alpine 3.24 | openssl | 1.1.1a-r0 |
| Alpine 3.9 | nodejs | 10.14.0-r0 |
| Alpine 3.9 | openssl | 1.1.1a-r0 |
| Arch Linux | lib32-openssl | 1:1.1.1.a-1 |
| Arch Linux | openssl | 1.1.1.a-1 |
| Chainguard | mysql-8.0 | 8.0.38-r0 |
| Chainguard | mysql-8.0-bitnami-compat | 8.0.38-r0 |
| Chainguard | mysql-8.0-client | 8.0.38-r0 |
| Chainguard | mysql-8.0-dev | 8.0.38-r0 |
| Chainguard | mysql-8.0-iamguarded-compat | 8.0.38-r0 |
| Chainguard | mysql-8.0-oci-entrypoint | 8.0.38-r0 |
| Chainguard | mysql-8.0-oci-entrypoint-compat | 8.0.38-r0 |
| Debian 12 | openssl | 1.1.1a-1 |
| Debian 13 | openssl | 1.1.1a-1 |
| Debian 14 | openssl | 1.1.1a-1 |
| Debian 8 | openssl | 1.0.1t-1+deb8u10 |
| Debian 9 | openssl | 1.1.0j-1~deb9u1 |
| Red Hat Enterprise Linux 7 | openssl | 1:1.0.2k-16.el7_6.1 |
| Red Hat Enterprise Linux 7 | openssl-debuginfo | 1:1.0.2k-16.el7_6.1 |
| Red Hat Enterprise Linux 7 | openssl-devel | 1:1.0.2k-16.el7_6.1 |
| Red Hat Enterprise Linux 7 | openssl-libs | 1:1.0.2k-16.el7_6.1 |
| Red Hat Enterprise Linux 7 | openssl-perl | 1:1.0.2k-16.el7_6.1 |
| Red Hat Enterprise Linux 7 | openssl-static | 1:1.0.2k-16.el7_6.1 |
| Red Hat Enterprise Linux 8 | openssl | 1:1.1.1c-2.el8 |
| Red Hat Enterprise Linux 8 | openssl-debuginfo | 1:1.1.1c-2.el8 |
| Red Hat Enterprise Linux 8 | openssl-debugsource | 1:1.1.1c-2.el8 |
| Red Hat Enterprise Linux 8 | openssl-devel | 1:1.1.1c-2.el8 |
| Red Hat Enterprise Linux 8 | openssl-libs | 1:1.1.1c-2.el8 |
| Red Hat Enterprise Linux 8 | openssl-libs-debuginfo | 1:1.1.1c-2.el8 |
| Red Hat Enterprise Linux 8 | openssl-perl | 1:1.1.1c-2.el8 |
| SUSE Linux Enterprise Desktop 12 SP4 | openssl-1_1 | 1.1.1-2.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | openssl-1_1 | 1.1.0i-4.15.1 |
| SUSE Linux Enterprise Server 12 SP4 | openssl-1_1 | 1.1.1-2.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | openssl-1_1 | 1.1.1-2.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | openssl-1_1 | 1.1.1-2.3.1 |
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.27 |
| Ubuntu 16.04 LTS | openssl | 1.0.2g-1ubuntu4.14 |
| Ubuntu 18.04 LTS | openssl | 1.1.0g-2ubuntu4.3 |
| Ubuntu 18.04 LTS | openssl1.0 | 1.0.2n-1ubuntu5.2 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 |