6.5

CVE-2018-0739: Constructed ASN.1 types with a recursive definition could exceed the stack

Modified
AliasesALPINE-CVE-2018-0739MGASA-2018-0190SUSE-SU-2018:0902-1
Published 27-03-2018Last modified 16-09-2024

Vulnerability summary

CVE-2018-0739 is a medium (CVSS 6.5) Uncontrolled Recursion vulnerability in canonical ubuntu_linux. EPSS estimates a 18.60% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.5/10
010
Medium · v3.0 (NVD)
EPSS score
18.60%
0%100%
Medium · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 11 · Related 7
MGASA-2018-0257MGASA-2018-0339OPENSUSE-SU-2024:11126-1OPENSUSE-SU-2024:11127-1OPENSUSE-SU-2024:11134-1OPENSUSE-SU-2024:11501-1

Timeline

  1. 27-03-2018
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

18.60%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 18.60% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat28 products
  • AAVMF< 0:20180508-3.gitee3198e672e2.el7
  • OVMF< 0:20180508-3.gitee3198e672e2.el7
  • tomcat-native< 0:1.2.17-19.redhat_19.ep7.el6 | < 0:1.2.17-19.redhat_19.ep7.el7
  • tomcat-native-debuginfo< 0:1.2.17-19.redhat_19.ep7.el6 | < 0:1.2.17-19.redhat_19.ep7.el7
  • tomcat7< 0:7.0.70-34.ep7.el6 | < 0:7.0.70-34.ep7.el7
Suse21 products
  • openssl1&distro=SUSE Linux Enterprise Server 11-SECURITY< 1.0.1g-0.58.9.1
  • openssl&distro=SUSE Linux Enterprise Desktop 12 SP2< 1.0.2j-60.24.1
  • openssl&distro=SUSE Linux Enterprise Desktop 12 SP3< 1.0.2j-60.24.1
  • openssl&distro=SUSE Linux Enterprise Server 11 SP4< 0.9.8j-0.106.9.1
  • openssl&distro=SUSE Linux Enterprise Server 12 SP1-LTSS< 1.0.1i-54.11.1
Debian4 products
  • libtomcrypt< 1.18.2-1
  • openssl< 1.0.1t-1+deb8u8 | < 1.1.0f-3+deb9u2 | < 1.0.1t-1+deb7u4 | < 1.1.0h-1
  • openssl1.0< 1.0.2l-2+deb9u3
  • debian_linuxEOL7.0 | 8.0 | 9.0
Mageia2 products
  • openssl< 1.0.2o-1.mga5
  • openssl< 1.0.2o-1.mga6
Ubuntu2 products
  • openssl< 1.1.0g-2ubuntu3 | < 1.0.1f-1ubuntu2.24 | < 1.0.2g-1ubuntu4.11
  • openssl1.0< 1.0.2n-1ubuntu5
Alpine1 product
  • openssl≥ 1.0.2b, < 1.0.2o-r0
Canonical1 product
Openssl1 product
  • opensslFixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g) | Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n) | ≥ 1.0.2b, ≤ 1.0.2n | ≥ 1.1.0, ≤ 1.1.0g

8 vendors · 60 products

References

69 links
Show all 69 references