Loading vulnerability…
OpenSSL Truncated-Packet Out-of-Bounds Read and Denial of Service
CVE-2017-3731 is an integer-underflow vulnerability in OpenSSL SSL/TLS packet processing that can cause an out-of-bounds read when a truncated packet is processed on a 32-bit host. The flaw affects both clients and servers using particular cipher suites: CHACHA20/POLY1305 in OpenSSL 1.1.0 through 1.1.0c, and RC4-MD5 in OpenSSL 1.0.2 through 1.0.2j. Vendor-maintained older branches, including certain OpenSSL 1.0.1 packages, are also affected. Exploitation usually crashes the process, causing denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can cause an affected SSL/TLS client or server process to crash, interrupting connections and potentially making dependent services unavailable. Repeated exploitation could prolong disruption. The principal established impact is loss of availability; OpenSSL and Red Hat assessments identify no confidentiality or integrity impact. Android separately classifies the issue as Moderate information disclosure in Runtime on Android 5.0.2 and 5.1.1, but specific disclosure mechanics are not established here. Arbitrary code execution is not established.
If you can’t patch tonight, do this now.
Pending patching, prevent negotiation of the affected cipher suites: disable RC4-MD5 on affected older branches and exclude CHACHA20/POLY1305 on affected OpenSSL 1.1.0 deployments. Restrict access to affected services where practical to reduce exposure. These measures do not replace installing the security update.
Patch, then assume compromise.
Upgrade affected OpenSSL 1.1.0 installations to 1.1.0d or later and affected OpenSSL 1.0.2 installations to 1.0.2k or later. For vendor-maintained packages, install the corresponding security update rather than relying solely on the upstream version number. Fixed Red Hat packages include OpenSSL 1.0.1e-48.el6_8.4 for RHEL 6 and 1.0.1e-60.el7_3.1 for RHEL 7 under RHSA-2017:0286. Echo provides version 1.0.1g+e1 or later. Affected JBoss Core Services deployments should apply the applicable RHSA-2018:2185, RHSA-2018:2186, or RHSA-2018:2187 update, which includes OpenSSL 1.0.2n. Supported affected Pixel/Nexus devices require Android security patch level 2017-11-05 or later. Restart applications and services linked against the updated OpenSSL library, or reboot, to activate the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.