CVE-2017-3733 in Oracle VM VirtualBox

Summary

During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.

Reservation

12/16/2016

Disclosure

05/04/2017

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
108254	Oracle VM VirtualBox OpenSSL input validation	20	Not defined	Official fix	CVE-2017-3733
97066	OpenSSL Encrypt-Then-Mac input validation	20	Not defined	Official fix	CVE-2017-3733