Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2017-3731: OpenSSL or Node.js may crash with certain cipher
CVE-2017-3731 · published 9 years ago
Summary
If a 32‑bit server or client uses OpenSSL (including Node.js which bundles it) and receives an incomplete message while using a specific encryption method, the software can read beyond its memory and crash. The problem shows up with the ChaCha20‑Poly1305 cipher in OpenSSL 1.1.0 and the RC4‑MD5 cipher in OpenSSL 1.0.2. Upgrade OpenSSL to version 1.1.0d or later, or to 1.0.2k or later, and disable the old RC4‑MD5 cipher if it is still enabled.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openssl | openssl |
1.1.0a 1.1.0b 1.1.0c 1.0.2 1.0.2a 1.0.2b 1.0.2c 1.0.2d 1.0.2e 1.0.2f 1.0.2h 1.0.2i 1 more version range
cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:* |
| nodejs | node.js |
>= 4.0.0, <= 4.1.2 >= 4.2.0, < 4.7.3 >= 5.0.0, <= 5.12.0 >= 6.0.0, <= 6.8.1 >= 6.9.0, < 6.9.5 >= 7.0.0, < 7.5.0 cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
Original advisory text
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually re...
If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.
References
- http://rhn.redhat.com/errata/RHSA-2017-0286.html Third Party Advisory
- http://www.debian.org/security/2017/dsa-3773 Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html Patch Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html Patch Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html Patch Third Party Advisory
- http://www.securityfocus.com/bid/95813 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1037717 Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2018:2185 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2186 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2187 Third Party Advisory
- https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd... Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc Third Party Advisory
- https://security.gentoo.org/glsa/201702-07 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20171019-0002/ Third Party Advisory
- https://security.paloaltonetworks.com/CVE-2017-3731 Third Party Advisory
- https://source.android.com/security/bulletin/pixel/2017-11-01 Third Party Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpe... Third Party Advisory
- https://www.openssl.org/news/secadv/20170126.txt Vendor Advisory
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html Patch Third Party Advisory
- https://www.tenable.com/security/tns-2017-04 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-125Out-of-bounds Read
Timeline
Published4 May 2017
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2017-3731 · NVD
Track software like this
Free during beta