During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade opensslUpgrade libressl | Jul 20, 2018 | Jun 12, 2018 |
| Amazon Linux Ami 2 | — | Upgrade openssl-perlUpgrade opensslUpgrade openssl-debuginfoUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-static | Apr 27, 2020 | Jun 12, 2018 |
| Amazon_linux | — | Upgrade openssl | Nov 2, 2018 | Jun 12, 2018 |
| Centos_linux | — | Upgrade openssl-debuginfoUpgrade openssl-staticUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-perlUpgrade openssl | Jun 10, 2019 | Jun 12, 2018 |
| Debian | — | Upgrade openssl | Dec 2, 2018 | Jun 12, 2018 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jul 20, 2018 |
| Freebsd | — | Upgrade libresslUpgrade node6Upgrade opensslUpgrade node8Upgrade openssl-develUpgrade libressl-develUpgrade node | Aug 25, 2018 | Aug 25, 2018 |
| Gentoo Linux | — | Upgrade dev-libs/openssl. | Nov 9, 2018 | Jun 12, 2018 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 13, 2018 | Jun 12, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade openssl-libsUpgrade openssl-develUpgrade openssl | Sep 27, 2018 | Jun 12, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade opensslUpgrade openssl-libsUpgrade openssl-devel | Jul 3, 2018 | Jun 12, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade openssl-develUpgrade openssl-libsUpgrade openssl | Jan 9, 2019 | Jun 12, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade compat-openssl10 | Jun 27, 2019 | Jun 12, 2018 |
| Huawei Euleros 2_0_sp9 | — | Upgrade shim | Sep 29, 2021 | Jun 12, 2018 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory28 | Sep 20, 2018 | Jun 12, 2018 |
| Oracle Solaris | — | Upgrade library/security/openssl to version 1.0.2.26-0.175.3.36.0.27.0 on Solaris 11.3Upgrade library/security/openssl/openssl-fips-140 to version 2.0.13-11.4.1.0.1.2.0 on Solaris 11.4Upgrade library/security/openssl/openssl-fips-140 to version 2.0.15-0.175.3.36.0.27.0 on Solaris 11.3Upgrade library/security/openssl to version 1.0.2.16-11.4.1.0.1.2.0 on Solaris 11.4 | Oct 19, 2018 | Jun 12, 2018 |
| Oracle_linux | — | Upgrade openssl-develUpgrade openssl-libsUpgrade openssl-staticUpgrade openssl-perlUpgrade openssl | Oct 13, 2018 | Jun 12, 2018 |
| Panos | — | Update PAN-OS 8.1 to the latest workaround for your deviceUpdate PAN-OS 7.1 to the latest workaround for your deviceUpdate PAN-OS 8.0 to the latest workaround for your device | Oct 12, 2018 | Jun 12, 2018 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Jun 12, 2018 |
| Redhat_linux | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-staticUpgrade openssl-develUpgrade openssl-debuginfoNo solution existsUpgrade openssl-libs | Oct 31, 2018 | Jun 12, 2018 |
| Suse | — | Upgrade mozillafirefox-branding-sledUpgrade firefox-glib2-toolsUpgrade compat-openssl097gUpgrade libopenssl1_0_0-x86Upgrade mozilla-nss-32bitUpgrade mozilla-nspr-32bitUpgrade libopenssl1_0_0-steam-32bitUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade virtualbox-guest-sourceUpgrade libfreebl3Upgrade openssl-docUpgrade firefox-libffi7Upgrade openssl-1_0_0-docUpgrade mozilla-nss-certsUpgrade nodejs6Upgrade firefox-gtk3-branding-upstreamUpgrade libopenssl1_1-hmacUpgrade mozillafirefox-translations-commonUpgrade firefox-gio-branding-upstreamUpgrade libopenssl1_1Upgrade firefox-atk-langUpgrade npm4Upgrade virtualbox-develUpgrade openssl-1_0_0Upgrade nodejs4-develUpgrade mozilla-nssUpgrade openssl-1_1Upgrade openssl1Upgrade firefox-libcairo2Upgrade firefox-libpango-1_0-0Upgrade firefox-libcairo-gobject2Upgrade libfirefox-gio-2_0-0Upgrade firefox-libgtk-3-0Upgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-ximUpgrade mozillafirefoxUpgrade virtualbox-vncUpgrade virtualbox-websrvUpgrade nodejs6-docsUpgrade virtualbox-qtUpgrade firefox-gtk3-toolsUpgrade libfirefox-gmodule-2_0-0Upgrade virtualbox-host-kmp-defaultUpgrade libopenssl0_9_8-hmac-32bitUpgrade libopenssl0_9_8-x86Upgrade virtualboxUpgrade libopenssl1_0_0-steamUpgrade nodejs4-docsUpgrade nodejs10Upgrade libfirefox-gobject-2_0-0Upgrade libopenssl1-develUpgrade openssl1-docUpgrade libsoftokn3Upgrade firefox-gtk3-langUpgrade openssl-1_0_0-cavsUpgrade mozilla-nspr-develUpgrade mozilla-nss-toolsUpgrade virtualbox-guest-kmp-defaultUpgrade firefox-libatk-1_0-0Upgrade mozillafirefox-translations-otherUpgrade npm8Upgrade virtualbox-guest-x11Upgrade opensslUpgrade mozilla-nsprUpgrade nodejs10-docsUpgrade nodejs10-develUpgrade virtualbox-guest-toolsUpgrade firefox-gtk3-immodule-thaiUpgrade libopenssl1_0_0Upgrade virtualbox-guest-desktop-iconsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodule-amharicUpgrade libopenssl1_0_0-32bitUpgrade libopenssl1_1-32bitUpgrade nodejs8-develUpgrade libsoftokn3-32bitUpgrade nodejs8Upgrade npm6Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs8-docsUpgrade firefox-libharfbuzz0Upgrade virtualbox-host-sourceUpgrade libopenssl1_1-hmac-32bitUpgrade libfirefox-gthread-2_0-0Upgrade libopenssl-1_1-devel-32bitUpgrade nodejs6-develUpgrade libopenssl-develUpgrade compat-openssl097g-32bitUpgrade python3-virtualboxUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfreebl3-32bitUpgrade libopenssl0_9_8-hmacUpgrade nodejs4Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade libopenssl0_9_8Upgrade libopenssl-1_0_0-develUpgrade libopenssl-devel-32bitUpgrade npm10Upgrade firefox-gtk3-immodule-vietnameseUpgrade libopenssl-1_1-develUpgrade firefox-gtk3-dataUpgrade firefox-libffi4Upgrade libopenssl1_0_0-hmacUpgrade openssl-1_1-docUpgrade libopenssl10Upgrade firefox-gdk-pixbuf-langUpgrade libopenssl-1_0_0-devel-32bitUpgrade libopenssl0_9_8-32bitUpgrade libopenssl1_0_0-hmac-32bit | Jul 7, 2018 | Jun 12, 2018 |
| Ubuntu | — | Upgrade libssl1.1Upgrade libssl1.0.0 | Jun 27, 2018 | Jun 12, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 12, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub