Patchwire CVEs, their patch status, and feeds to follow them

CVE-2018-0739

Fixed in a distro release EPSS 19%

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

Published 2018-03-27 · CVE record · OSV

Products: OpenSSL

Distro releases

ReleasePackageFixed in
Alpine:v3.3openssl1.0.2o-r0
Alpine:v3.4openssl1.0.2o-r0
Alpine:v3.5openssl1.0.2o-r0
Alpine:v3.6openssl1.0.2o-r0
Alpine:v3.7openssl1.0.2o-r0
Alpine:v3.8openssl1.0.2o-r0
Debian:12libtomcrypt1.18.2-1
Debian:12openssl1.1.0h-1
Debian:13libtomcrypt1.18.2-1
Debian:13openssl1.1.0h-1
Debian:14libtomcrypt1.18.2-1
Debian:14openssl1.1.0h-1
Debian:7openssl1.0.1t-1+deb7u4
Debian:8openssl1.0.1t-1+deb8u8
Debian:9openssl1.1.0f-3+deb9u2
Debian:9openssl1.01.0.2l-2+deb9u3
Red Hat:enterprise_linux:7AAVMF0:20180508-3.gitee3198e672e2.el7
Red Hat:enterprise_linux:7OVMF0:20180508-3.gitee3198e672e2.el7
Red Hat:enterprise_linux:7openssl1:1.0.2k-16.el7
Red Hat:enterprise_linux:7openssl-debuginfo1:1.0.2k-16.el7
Red Hat:enterprise_linux:7openssl-devel1:1.0.2k-16.el7
Red Hat:enterprise_linux:7openssl-libs1:1.0.2k-16.el7
Red Hat:enterprise_linux:7openssl-perl1:1.0.2k-16.el7
Red Hat:enterprise_linux:7openssl-static1:1.0.2k-16.el7
Red Hat:enterprise_linux:7ovmf0:20180508-3.gitee3198e672e2.el7
Red Hat:jboss_core_services:1jbcs-httpd240:1-6.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd240:1-6.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apache-commons-daemon-jsvc1:1.1.0-3.redhat_2.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apache-commons-daemon-jsvc1:1.1.0-3.redhat_2.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo1:1.1.0-3.redhat_2.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo1:1.1.0-3.redhat_2.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr0:1.6.3-31.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr0:1.6.3-31.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-debuginfo0:1.6.3-31.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-debuginfo0:1.6.3-31.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-devel0:1.6.3-31.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-devel0:1.6.3-31.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-debuginfo0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-debuginfo0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-devel0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-devel0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-ldap0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-ldap0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-mysql0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-mysql0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-nss0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-nss0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-odbc0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-odbc0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-openssl0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-openssl0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-pgsql0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-pgsql0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-sqlite0:1.6.1-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-sqlite0:1.6.1-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd0:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd0:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-debuginfo0:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-debuginfo0:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-devel0:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-devel0:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-manual0:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-manual0:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-selinux0:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-selinux0:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-tools0:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-tools0:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_cluster-native0:1.3.8-3.Final_redhat_2.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_cluster-native0:1.3.8-3.Final_redhat_2.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_cluster-native-debuginfo0:1.3.8-3.Final_redhat_2.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_cluster-native-debuginfo0:1.3.8-3.Final_redhat_2.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk0:1.2.46-1.redhat_1.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk0:1.2.46-1.redhat_1.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-ap240:1.2.46-1.redhat_1.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-ap240:1.2.46-1.redhat_1.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-debuginfo0:1.2.46-1.redhat_1.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-debuginfo0:1.2.46-1.redhat_1.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-manual0:1.2.46-1.redhat_1.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-manual0:1.2.46-1.redhat_1.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_ldap0:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_ldap0:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_proxy_html1:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_proxy_html1:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_session0:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_session0:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_ssl1:2.4.29-35.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_ssl1:2.4.29-35.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp20:1.29.0-9.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp20:1.29.0-9.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp2-debuginfo0:1.29.0-9.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp2-debuginfo0:1.29.0-9.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp2-devel0:1.29.0-9.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp2-devel0:1.29.0-9.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl1:1.0.2n-14.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl1:1.0.2n-14.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-debuginfo1:1.0.2n-14.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-debuginfo1:1.0.2n-14.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-devel1:1.0.2n-14.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-devel1:1.0.2n-14.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-libs1:1.0.2n-14.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-libs1:1.0.2n-14.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-perl1:1.0.2n-14.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-perl1:1.0.2n-14.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-static1:1.0.2n-14.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-static1:1.0.2n-14.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-runtime0:1-6.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-runtime0:1-6.jbcs.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat-native0:1.2.17-19.redhat_19.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat-native0:1.2.17-19.redhat_19.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat-native-debuginfo0:1.2.17-19.redhat_19.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat-native-debuginfo0:1.2.17-19.redhat_19.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat70:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat70:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-admin-webapps0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-admin-webapps0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-docs-webapp0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-docs-webapp0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-el-2.2-api0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-el-2.2-api0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-javadoc0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-javadoc0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-jsp-2.2-api0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-jsp-2.2-api0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-jsvc0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-jsvc0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-lib0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-lib0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-log4j0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-log4j0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-selinux0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-selinux0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-servlet-3.0-api0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-servlet-3.0-api0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat7-webapps0:7.0.70-34.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat7-webapps0:7.0.70-34.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat80:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat80:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-admin-webapps0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-admin-webapps0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-docs-webapp0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-docs-webapp0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-el-2.2-api0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-el-2.2-api0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-javadoc0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-javadoc0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-jsp-2.3-api0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-jsp-2.3-api0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-jsvc0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-jsvc0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-lib0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-lib0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-log4j0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-log4j0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-selinux0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-selinux0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-servlet-3.1-api0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-servlet-3.1-api0:8.0.36-39.ep7.el7
Red Hat:jboss_enterprise_web_server:3.1tomcat8-webapps0:8.0.36-39.ep7.el6
Red Hat:jboss_enterprise_web_server:3.1tomcat8-webapps0:8.0.36-39.ep7.el7
SUSE:Linux Enterprise Desktop 12 SP2openssl1.0.2j-60.24.1
SUSE:Linux Enterprise Desktop 12 SP3compat-openssl0980.9.8j-106.6.1
SUSE:Linux Enterprise Desktop 12 SP3openssl1.0.2j-60.24.1
SUSE:Linux Enterprise Module for Legacy 12compat-openssl0980.9.8j-106.6.1
SUSE:Linux Enterprise Module for Server Applications 15ovmf2017+git1510945757.b2662641d5-5.3.6
SUSE:Linux Enterprise Server 11 SP4openssl0.9.8j-0.106.9.1
SUSE:Linux Enterprise Server 11-SECURITYopenssl11.0.1g-0.58.9.1
SUSE:Linux Enterprise Server 12 SP1-LTSSopenssl1.0.1i-54.11.1
SUSE:Linux Enterprise Server 12 SP2openssl1.0.2j-60.24.1
SUSE:Linux Enterprise Server 12 SP2-BCLovmf2015+git1462940744.321151f-19.10.3
SUSE:Linux Enterprise Server 12 SP2-LTSSovmf2015+git1462940744.321151f-19.10.3
SUSE:Linux Enterprise Server 12 SP3openssl1.0.2j-60.24.1
SUSE:Linux Enterprise Server 12 SP3ovmf2017+git1492060560.b6d11d7c46-4.9.4
SUSE:Linux Enterprise Server 12-LTSSopenssl1.0.1i-27.31.1
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2openssl1.0.2j-60.24.1
SUSE:Linux Enterprise Server for SAP Applications 11 SP4compat-openssl097g0.9.7g-146.22.51.5.1
SUSE:Linux Enterprise Server for SAP Applications 11 SP4openssl0.9.8j-0.106.9.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP1compat-openssl0980.9.8j-106.6.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP1openssl1.0.1i-54.11.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP2compat-openssl0980.9.8j-106.6.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP2openssl1.0.2j-60.24.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP2ovmf2015+git1462940744.321151f-19.10.3
SUSE:Linux Enterprise Server for SAP Applications 12 SP3compat-openssl0980.9.8j-106.6.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP3openssl1.0.2j-60.24.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP3ovmf2017+git1492060560.b6d11d7c46-4.9.4
SUSE:Linux Enterprise Software Development Kit 11 SP4openssl0.9.8j-0.106.9.1
SUSE:Linux Enterprise Software Development Kit 12 SP2openssl1.0.2j-60.24.1
SUSE:Linux Enterprise Software Development Kit 12 SP3openssl1.0.2j-60.24.1
SUSE:OpenStack Cloud 6openssl1.0.1i-54.11.1
SUSE:OpenStack Cloud 7ovmf2015+git1462940744.321151f-19.10.3
SUSE:Studio Onsite 1.3openssl0.9.8j-0.106.9.1
Ubuntu:14.04:LTSopenssl1.0.1f-1ubuntu2.24
Ubuntu:16.04:LTSopenssl1.0.2g-1ubuntu4.11
Ubuntu:18.04:LTSopenssl1.1.0g-2ubuntu3
Ubuntu:18.04:LTSopenssl1.01.0.2n-1ubuntu5
openSUSE:Tumbleweedopenssl-1_0_01.0.2u-6.2
openSUSE:Tumbleweedopenssl-1_11.1.1l-1.2
openSUSE:Tumbleweedovmf202105-3.4
openSUSE:Tumbleweedvirtualbox6.1.26-3.2