CVE-2017-3730: openssl NULL Pointer Dereference
Vulnerability summary
CVE-2017-3730 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in openssl. EPSS estimates a 55.29% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 04-05-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
55.29%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 55.29% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOpenSSL 1.1.0 - Remote Client Denial of Service
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Oracle6 products
- agile_engineering_data_management6.1.3 | 6.2.0
- communications_application_session_controller3.7.1 | 3.8.0
- communications_eagle_lnp_application_processor10.0 | 10.1 | 10.2
- communications_operations_monitor3.4 | 4.0
- jd_edwards_enterpriseone_tools9.2
Debian1 product
- openssl< 1.1.0d-1
Openssl1 product
- opensslEOLopenssl-1.1.0 | openssl-1.1.0a | openssl-1.1.0b | openssl-1.1.0c | 1.1.0 | 1.1.0a | 1.1.0b | 1.1.0c
3 vendors · 8 products
References
11 links- github.com/openssl/openssl/commit/efbe126e3ebb9123ac9d058aa2bb044261342aaaX Refsource MISCPatchThird Party Advisory
- support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_usX Refsource CONFIRMThird Party Advisory
