CVE-2017-3731 log
| Source |
|
| Severity | Medium |
| Remote | Yes |
| Type | Denial of service |
| Description | If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-155 | lib32-openssl | 1:1.0.2.j-1 | 1:1.0.2.k-1 | Medium | Fixed | |
| AVG-154 | openssl | 1.0.2.j-1 | 1.0.2.k-1 | Medium | Fixed |
| Date | Advisory | Group | Package | Severity | Type |
|---|---|---|---|---|---|
| 28 Jan 2017 | ASA-201701-37 | AVG-154 | openssl | Medium | multiple issues |
| 27 Jan 2017 | ASA-201701-36 | AVG-155 | lib32-openssl | Medium | multiple issues |
| References |
|---|
https://www.openssl.org/news/secadv/20170126.txt |