Summary
It was discovered that OpenSSL incorrectly parsed the IPAddressFamily
extension in X.509 certificates, resulting in an erroneous display of the
certificate in text format. (CVE-2017-3735)
It was discovered that OpenSSL incorrectly performed the x86_64 Montgomery
squaring procedure. While unlikely, a remote attacker could possibly use
this issue to recover private keys. This issue only applied to Ubuntu 16.04
LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-3736)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | openssl | 1.0.1f-1ubuntu2.23 |
| Ubuntu · 16.04 LTS 16.04:LTS | openssl | 1.0.2g-1ubuntu4.9 |
Vulnerabilities 2
-
Unscored —CVE-2017-3735 EPSS 21%
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This woul…
-
Unscored —CVE-2017-3736 EPSS 10%
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before …