Skip to content
OpenAdvisories
Unscored USN-3628-1 1 CVE

openssl vulnerability

Published Apr 19, 2018 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia
discovered that OpenSSL incorrectly handled RSA key generation. An attacker could possibly
use this issue to perform a cache-timing attack and recover private RSA keys.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS openssl 1.0.1f-1ubuntu2.25
Ubuntu · 16.04 LTS 16.04:LTS openssl 1.0.2g-1ubuntu4.12

Vulnerabilities 1

  • Unscored —
    CVE-2018-0737 EPSS 12%

    Cache timing vulnerability in RSA Key Generation

    The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in Open…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2018-0737