CVE-2018-0735

Description

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

CVSS breakdown

Affected products

• Canonical / Ubuntu Linux14.04 – 14.04
• Canonical / Ubuntu Linux18.10 – 18.10
• Canonical / Ubuntu Linux18.04 – 18.04
• Canonical / Ubuntu Linux16.04 – 16.04
• Debian / debian_linux8.0 – 8.0
• Debian / debian_linux9.0 – 9.0
• NetApp / cloud_backup
• NetApp / cn1610_firmware
• NetApp / element_software
• NetApp / OnCommand Unified Manager
• NetApp / OnCommand Unified Manager9.4 –
• NetApp / santricity_smi-s_provider
• NetApp / smi-s_provider
• NetApp / snapdrive
• NetApp / snapdrive
• NetApp / steelstore
• nodejs / node.js10.13.0 – 10.13.0
• nodejs / node.js10.0.0 – 10.12.0
• OpenSSL / OpenSSLFixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i) – Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i)
• OpenSSL / OpenSSL1.1.1 – 1.1.1
• OpenSSL / OpenSSL1.1.0 – 1.1.0i
• OpenSSL / OpenSSLFixed in OpenSSL 1.1.1a (Affected 1.1.1) – Fixed in OpenSSL 1.1.1a (Affected 1.1.1)
• oracle / api_gateway11.1.2.4.0 – 11.1.2.4.0
• oracle / application_server0.9.8 – 0.9.8
• oracle / application_server1.0.0 – 1.0.0
• oracle / application_server1.0.1 – 1.0.1
• oracle / enterprise_manager_base_platform12.1.0.5.0 – 12.1.0.5.0
• oracle / enterprise_manager_base_platform13.2.0.0.0 – 13.2.0.0.0
• oracle / enterprise_manager_base_platform13.3.0.0.0 – 13.3.0.0.0
• oracle / enterprise_manager_ops_center12.3.3 – 12.3.3
• oracle / mysql5.6.42
• oracle / peoplesoft_enterprise_peopletools8.55 – 8.55
• oracle / peoplesoft_enterprise_peopletools8.56 – 8.56
• oracle / peoplesoft_enterprise_peopletools8.57 – 8.57
• oracle / primavera_p6_enterprise_project_portfolio_management17.7 – 17.12
• oracle / primavera_p6_enterprise_project_portfolio_management8.4 – 8.4
• oracle / primavera_p6_enterprise_project_portfolio_management15.1 – 15.1
• oracle / primavera_p6_enterprise_project_portfolio_management15.2 – 15.2
• oracle / primavera_p6_enterprise_project_portfolio_management16.1 – 16.1
• oracle / primavera_p6_enterprise_project_portfolio_management16.2 – 16.2
• oracle / primavera_p6_enterprise_project_portfolio_management18.8 – 18.8
• oracle / secure_global_desktop5.4 – 5.4
• oracle / tuxedo12.1.1.0.0 – 12.1.1.0.0
• oracle / vm_virtualbox6.0.0

References

• MISChttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56fb454d281a023b3f950d969693553d3f3ceea1
• VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• MISChttp://www.securityfocus.com/bid/105750
• VENDOR_ADVISORYhttps://usn.ubuntu.com/3840-1/
• MISChttps://security.netapp.com/advisory/ntap-20181105-0002/
• MISChttps://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
• MISChttp://www.securitytracker.com/id/1041986
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2018/11/msg00024.html
• VENDOR_ADVISORYhttps://www.debian.org/security/2018/dsa-4348
• MISChttps://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b1d6d55ece1c26fa2829e2b819b038d7b6d692b4
• MISChttps://www.openssl.org/news/secadv/20181029.txt
• VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• VENDOR_ADVISORYhttps://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
• VENDOR_ADVISORYhttps://access.redhat.com/errata/RHSA-2019:3700
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2020.html