CVE-2018-0732 in Fujitsu M10-1info

Summary

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Be aware that VulDB is the high quality source for vulnerability data.

Reservation

11/30/2017

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
143749	Oracle Fujitsu M10-1 OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
137890	Oracle Diameter Signaling Router (DSR) OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
133654	Oracle JD Edwards EnterpriseOne Tools Enterprise Infrastructure SEC denial of service	404	Not defined	Official fix	CVE-2018-0732
133509	Oracle Communications Operations Monitor OpenSSL denial of service	404	Not defined	Official fix	CVE-2018-0732
133507	Oracle Communications EAGLE LNP Application Processor OpenSSL denial of service	404	Not defined	Official fix	CVE-2018-0732
133506	Oracle Communications Application Session Controller OpenSSL denial of service	404	Not defined	Official fix	CVE-2018-0732
129704	Oracle OSS Support Tools Services Tools Bundle key management	320	Not defined	Official fix	CVE-2018-0732
129700	Oracle Agile Engineering Data Management OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
129654	Oracle PeopleSoft Enterprise PeopleTools OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
129650	Oracle MySQL Enterprise Monitor Monitoring key management	320	Not defined	Official fix	CVE-2018-0732
129623	Oracle MySQL Workbench OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
129620	Oracle JD Edwards World Security OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
129544	Oracle Endeca Server libssh key management	320	Not defined	Official fix	CVE-2018-0732
129542	Oracle API Gateway Apache Batik key management	320	Not defined	Official fix	CVE-2018-0732
129515	Oracle Enterprise Manager Ops Center Jasper Project key management	320	Not defined	Official fix	CVE-2018-0732
129513	Oracle Enterprise Manager Base Platform Bouncy Castle Java key management	320	Not defined	Official fix	CVE-2018-0732
129491	Oracle Primavera P6 Enterprise Project Portfolio Management jackson-databind key management	320	Not defined	Official fix	CVE-2018-0732
129488	Oracle Enterprise Session Border Controller OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
129487	Oracle Enterprise Communications Broker jackson-databind key management	320	Not defined	Official fix	CVE-2018-0732
129486	Oracle Communications WebRTC Session Controller jQuery FileUpload key management	320	Not defined	Official fix	CVE-2018-0732
129485	Oracle Communications Unified Session Manager OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
129484	Oracle Communications Session Border Controller OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
125666	Oracle VM VirtualBox OpenSSL key management	320	Not defined	Official fix	CVE-2018-0732
125444	Oracle Tuxedo Docs-ATMI-IB key management	320	Not defined	Official fix	CVE-2018-0732
119378	OpenSSL TLS Handshake key management	320	Not defined	Official fix	CVE-2018-0732

Description

CPE

CWE

CVSS

Exploits

History

Diff

Relate

Threat Intelligence

API JSON

API XML

API CSV

Sources

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!