Loading vulnerability…
NULL Pointer Dereference in OpenSSL DHE/ECDHE Client Key Exchange Handling
CVE-2017-3730 is a denial-of-service vulnerability in OpenSSL 1.1.0 before 1.1.0d. When an OpenSSL client processes maliciously crafted parameters supplied by a server during a DHE or ECDHE key exchange, the client can attempt to dereference a NULL pointer and crash. The issue affects client-side handling of ephemeral Diffie-Hellman and elliptic-curve Diffie-Hellman key exchange parameters during TLS negotiation. OpenSSL 1.0.2 is not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes the vulnerable OpenSSL client process to crash, resulting in denial of service. The available information indicates client termination due to a NULL pointer dereference; no evidence is provided that this issue enables code execution, privilege escalation, or confidentiality compromise.
If you can’t patch tonight, do this now.
Limit exposure of vulnerable clients to untrusted or attacker-controlled TLS servers until patched. Where operationally feasible, avoid connections to untrusted endpoints that can present malicious DHE or ECDHE parameters. The primary mitigation is upgrading to a fixed OpenSSL release; no specific workaround is documented in the available information.
Patch, then assume compromise.
Upgrade OpenSSL from affected 1.1.0 releases to OpenSSL 1.1.0d or later. Products statically or dynamically linked against vulnerable OpenSSL 1.1.0 builds should be updated to a fixed release provided by the vendor. OpenSSL 1.0.2 does not require remediation for this specific CVE.
No validated public exploits yet. Hidden: 1 not yet analyzed, such as Exploit-DB entries.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.