CVE-2018-0732— Openssl OpenSSL 加密问题漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

OpenSSL OpenSSL

利用判断

利用概率较高，应尽快评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 1.1.0版本至1.1.0h版本和1.0.2版本至1.0.2o版本中存在加密问题漏洞。该漏洞源于网络系统或产品未正确使用相关密码算法，导致内容未正确加密、弱加密、明文存储敏感信息等。

CVE-2018-0732 影响 OpenSSL OpenSSL。利用概率较高，应尽快评估。OpenSSL是OpenSSL团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 1.1.0版本至1.1.0h版本和1.0.2版本至1.0.2o版本中存在加密问题漏洞。该漏洞源于网络系统或产品未正确使用相关密码算法，导致内容未正确加 CVE-2018-0732 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2018-0732

一、 漏洞 CVE-2018-0732 基础信息

受影响产品

二、漏洞 CVE-2018-0732 的公开POC

三、漏洞 CVE-2018-0732 的情报信息

CVE-2018-0732 厂商安全公告 (23)

• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISC
• https://security.netapp.com/advisory/ntap-20190118-0002/ x_refsource_CONFIRM
• http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html x_refsource_CONFIRM
• https://www.oracle.com/security-alerts/cpuapr2020.html x_refsource_MISC
• https://cert-portal.siemens.com/productcert/pdf/ssa-419820.pdf x_refsource_CONFIRM
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html x_refsource_MISC
• https://www.openssl.org/news/secadv/20180612.txt x_refsource_CONFIRM
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html x_refsource_MISC
• https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html x_refsource_CONFIRM
• https://www.oracle.com/security-alerts/cpujan2021.html x_refsource_MISC
• https://security.netapp.com/advisory/ntap-20181105-0001/ x_refsource_CONFIRM
• http://www.securityfocus.com/bid/104442 vdb-entry x_refsource_BID
• http://www.securitytracker.com/id/1041090 vdb-entry x_refsource_SECTRACK
• https://www.debian.org/security/2018/dsa-4348 vendor-advisory x_refsource_DEBIAN
• https://www.debian.org/security/2018/dsa-4355 vendor-advisory x_refsource_DEBIAN
• https://usn.ubuntu.com/3692-2/ vendor-advisory x_refsource_UBUNTU
• USN-3692-1: OpenSSL vulnerabilities | Ubuntu security notices | Ubuntu vendor-advisory x_refsource_UBUNTU
• https://security.gentoo.org/glsa/201811-03 vendor-advisory x_refsource_GENTOO
• https://access.redhat.com/errata/RHSA-2019:1543 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2018:2552 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2018:2553 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2019:1296 vendor-advisory x_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2018:3221 vendor-advisory x_refsource_REDHAT

CVE-2018-0732 邮件列表归档 (4)

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/ vendor-advisory x_refsource_FEDORA
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/ vendor-advisory x_refsource_FEDORA
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/ vendor-advisory x_refsource_FEDORA
• https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html mailing-list x_refsource_MLIST

CVE-2018-0732 安全博客文章 (1)

• https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/ x_refsource_CONFIRM

CVE-2018-0732 其他参考 (7)

• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ea7abeeabf92b7aca160bdd0208636d4da69f4f4 x_refsource_CONFIRM
• https://www.tenable.com/security/tns-2018-14 x_refsource_CONFIRM
• https://www.tenable.com/security/tns-2018-17 x_refsource_CONFIRM
• https://securityadvisories.paloaltonetworks.com/Home/Detail/133 x_refsource_CONFIRM
• https://www.tenable.com/security/tns-2018-12 x_refsource_CONFIRM
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3984ef0b72831da8b3ece4745cac4f8575b19098 x_refsource_CONFIRM
• https://www.tenable.com/security/tns-2018-13 x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2018-0732

IV. Related Vulnerabilities

V. Comments for CVE-2018-0732