CVE-2017-3730
Bad (EC)DHE parameters cause a client crash
- State
- Published
- Severity
- Not scored
- Published
- May 4, 2017
- Updated
- Sep 16, 2024
- Reserved
- Dec 16, 2016
Description
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
OpenSSLOpenSSL |
|
References
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- 41192exploit
- 95812vdb-entry
- https://github.com/openssl/openssl/commit/efbe126e3ebb9123ac9d058aa2bb044261342aaa
- https://www.openssl.org/news/secadv/20170126.txt
- 1037717vdb-entry
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- GLSA-201702-07vendor-advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.