CVE-2018-0735 (NVD)

2018-10-29

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

Products Ubuntu_linux, Debian_linux, Cloud_backup, Cn1610_firmware, Element_software, Oncommand_unified_manager, Santricity_smi\-S_provider, Smi\-S_provider, Snapdrive, Steelstore, Node\.js, Openssl, Api_gateway, Application_server, Enterprise_manager_base_platform, Enterprise_manager_ops_center, Mysql, Peoplesoft_enterprise_peopletools, Primavera_p6_enterprise_project_portfolio_management, Secure_global_desktop, Tuxedo, Vm_virtualbox
Type Use of a Broken or Risky Cryptographic Algorithm (CWE-327)
First patch - None (likely due to unavailable code)
Links • https://www.oracle.com/security-alerts/cpujan2020.html
• http://www.securitytracker.com/id/1041986
• https://www.debian.org/security/2018/dsa-4348
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56fb454d281a023b3f950d969693553d3f3ceea1