VulnerableCode Package Details - pkg:alpm/archlinux/openssl@1.1.0.i-1

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-9cyz-en38-aaad	During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).	CVE-2018-0732 VC-OPENSSL-20180612-CVE-2018-0732
VCID-j8pb-xdpc-aaap	The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).	CVE-2018-0737 VC-OPENSSL-20180416-CVE-2018-0737

Vulnerability

Summary

Aliases

VCID-9cyz-en38-aaad

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

CVE-2018-0732
VC-OPENSSL-20180612-CVE-2018-0732

VCID-j8pb-xdpc-aaap

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

CVE-2018-0737
VC-OPENSSL-20180416-CVE-2018-0737

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-03-28T07:47:06.426752+00:00	Arch Linux Importer	Fixing	VCID-9cyz-en38-aaad	https://security.archlinux.org/AVG-674	36.0.0
2025-03-28T07:47:06.408079+00:00	Arch Linux Importer	Fixing	VCID-j8pb-xdpc-aaap	https://security.archlinux.org/AVG-674	36.0.0
2024-09-18T02:02:30.330308+00:00	Arch Linux Importer	Fixing	VCID-9cyz-en38-aaad	https://security.archlinux.org/AVG-674	34.0.1
2024-09-18T02:02:30.309906+00:00	Arch Linux Importer	Fixing	VCID-j8pb-xdpc-aaap	https://security.archlinux.org/AVG-674	34.0.1
2024-01-03T22:28:30.922651+00:00	Arch Linux Importer	Fixing	VCID-9cyz-en38-aaad	https://security.archlinux.org/AVG-674	34.0.0rc1
2024-01-03T22:28:30.893945+00:00	Arch Linux Importer	Fixing	VCID-j8pb-xdpc-aaap	https://security.archlinux.org/AVG-674	34.0.0rc1