high7.5Public exploit code

CVE-2017-3730

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

OpenSSL 1.1.0 - Remote Client Denial of Service2017-01-26 · dos · multiple

Impact

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.

Affected products

Vendor	Product	Affected versions
Openssl	Openssl	Versions 1.1.0, 1.1.0a, 1.1.0b, 1.1.0c
Oracle	Agile Engineering Data Management	Versions 6.1.3, 6.2.0
Oracle	Communications Application Session Controller	Versions 3.7.1, 3.8.0
Oracle	Communications Eagle Lnp Application Processor	Versions 10.0, 10.1, 10.2
Oracle	Communications Operations Monitor	Versions 3.4, 4.0
Oracle	Jd Edwards Enterpriseone Tools	Version 9.2
Oracle	Jd Edwards World Security	Versions a9.1, a9.2, a9.3, a9.4

Weakness classification

CWE-476

Public exploit code

Impact

Affected products

Weakness classification

References