NVD Vulnerability Detail

CVE-2018-0734

Summary	The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).
Publication Date	Oct. 30, 2018, 9:29 p.m.
Registration Date	March 1, 2021, 6:38 p.m.
Last Update	Nov. 21, 2024, 12:38 p.m.

CVSS3.1 : MEDIUM
スコア	5.9
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	高
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	なし
可用性への影響(A)	なし

CVSS2.0 : MEDIUM
Score	4.3
Vector	AV:N/AC:M/Au:N/C:P/I:N/A:N
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	なし
可用性への影響(A)	なし
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openssl:openssl:1.1.1:::::::*
cpe:2.3:a:openssl:openssl::::::::	1.0.2	1.0.2p
cpe:2.3:a:openssl:openssl::::::::	1.1.0	1.1.0i

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:nodejs:node.js:::::-:::*	6.0.0	6.8.1
cpe:2.3:a:nodejs:node.js:::::-:::*	8.0.0	8.8.1
cpe:2.3:a:nodejs:node.js:::::-:::*	10.0.0	10.12.0
cpe:2.3:a:nodejs:node.js:::::lts:::*	6.9.0			6.15.0
cpe:2.3:a:nodejs:node.js:::::lts:::*	8.9.0			8.14.0
cpe:2.3:a:nodejs:node.js:10.13.0::::lts:::
cpe:2.3:a:nodejs:node.js:::::-:::*	11.0.0			11.3.0

Configuration5		or higher	or less	more than	less than
cpe:2.3:o:netapp:cn1610_firmware:-:::::::*
execution environment
1	cpe:2.3:h:netapp:cn1610:-:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:a:netapp:cloud_backup:-:::::::*
cpe:2.3:a:netapp:oncommand_unified_manager::::::::
cpe:2.3:a:netapp:steelstore:-:::::::*
cpe:2.3:a:netapp:santricity_smi-s_provider:-:::::::*
cpe:2.3:a:netapp:snapcenter:-:::::::*
cpe:2.3:a:netapp:storage_automation_store:-:::::::*

Configuration7	or higher	or less	more than	less than
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:::::::*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:::::::*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:::::::*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:::::::*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:::::::*
cpe:2.3:a:oracle:mysql_enterprise_backup::::::::	3.0	3.12.3
cpe:2.3:a:oracle:mysql_enterprise_backup::::::::	4.0	4.1.2
cpe:2.3:a:oracle:primavera_p6_professional_project_management:15.2:::::::*
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:18.8:::::::*
cpe:2.3:a:oracle:tuxedo:12.1.1.0.0:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:16.2:::::::*
cpe:2.3:a:oracle:e-business_suite_technology_stack:0.9.8:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:15.1:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management::::::::	17.7	17.12
cpe:2.3:a:oracle:e-business_suite_technology_stack:1.0.1:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:16.1:::::::*
cpe:2.3:a:oracle:e-business_suite_technology_stack:1.0.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:8.4:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html	Mailing List Third Party Advisory
5	http://www.securityfocus.com/bid/105758	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/105758	Third Party Advisory VDB Entry
7	https://access.redhat.com/errata/RHSA-2019:2304	Third Party Advisory
8	https://access.redhat.com/errata/RHSA-2019:2304	Third Party Advisory
9	https://access.redhat.com/errata/RHSA-2019:3700	Third Party Advisory
10	https://access.redhat.com/errata/RHSA-2019:3700	Third Party Advisory
11	https://access.redhat.com/errata/RHSA-2019:3932	Third Party Advisory
12	https://access.redhat.com/errata/RHSA-2019:3932	Third Party Advisory
13	https://access.redhat.com/errata/RHSA-2019:3933	Third Party Advisory
14	https://access.redhat.com/errata/RHSA-2019:3933	Third Party Advisory
15	https://access.redhat.com/errata/RHSA-2019:3935	Third Party Advisory
16	https://access.redhat.com/errata/RHSA-2019:3935	Third Party Advisory
17	https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac
18	https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac
19	https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f
20	https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f
21	https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7
22	https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=ef11e19d1365eea2b1851e6f540a0bf365d303e7
23	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/
24	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/
25	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/
26	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/
27	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/
28	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/
29	https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/	Third Party Advisory
30	https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/	Third Party Advisory
31	https://security.netapp.com/advisory/ntap-20181105-0002/	Third Party Advisory
32	https://security.netapp.com/advisory/ntap-20181105-0002/	Third Party Advisory
33	https://security.netapp.com/advisory/ntap-20190118-0002/	Third Party Advisory
34	https://security.netapp.com/advisory/ntap-20190118-0002/	Third Party Advisory
35	https://security.netapp.com/advisory/ntap-20190423-0002/	Third Party Advisory
36	https://security.netapp.com/advisory/ntap-20190423-0002/	Third Party Advisory
37	https://usn.ubuntu.com/3840-1/	Third Party Advisory
38	https://usn.ubuntu.com/3840-1/	Third Party Advisory
39	https://www.debian.org/security/2018/dsa-4348	Third Party Advisory
40	https://www.debian.org/security/2018/dsa-4348	Third Party Advisory
41	https://www.debian.org/security/2018/dsa-4355	Third Party Advisory
42	https://www.debian.org/security/2018/dsa-4355	Third Party Advisory
43	https://www.openssl.org/news/secadv/20181030.txt	Vendor Advisory
44	https://www.openssl.org/news/secadv/20181030.txt	Vendor Advisory
45	https://www.oracle.com/security-alerts/cpuapr2020.html	Third Party Advisory
46	https://www.oracle.com/security-alerts/cpuapr2020.html	Third Party Advisory
47	https://www.oracle.com/security-alerts/cpujan2020.html	Third Party Advisory
48	https://www.oracle.com/security-alerts/cpujan2020.html	Third Party Advisory
49	https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Third Party Advisory
50	https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Third Party Advisory
51	https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	Patch Third Party Advisory
52	https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html	Patch Third Party Advisory
53	https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	Patch Third Party Advisory
54	https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html	Patch Third Party Advisory
55	https://www.tenable.com/security/tns-2018-16	Third Party Advisory
56	https://www.tenable.com/security/tns-2018-16	Third Party Advisory
57	https://www.tenable.com/security/tns-2018-17	Third Party Advisory
58	https://www.tenable.com/security/tns-2018-17	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-327	不完全、または危険な暗号アルゴリズムの使用	https://cwe.mitre.org/data/definitions/327.html

JVN Vulnerability Information

OpenSSL DSA 署名アルゴリズムにおける鍵管理のエラーに関する脆弱性

Title	OpenSSL DSA 署名アルゴリズムにおける鍵管理のエラーに関する脆弱性
Summary	OpenSSL DSA 署名アルゴリズムには、鍵管理のエラーに関する脆弱性が存在します
Possible impacts	情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 30, 2018, midnight
Registration Date	March 11, 2019, 2:01 p.m.
Last Update	March 11, 2019, 2:01 p.m.

Affected System

OpenSSL Project

OpenSSL 1.0.2 から 1.0.2p

OpenSSL 1.1.0 から 1.1.0i

OpenSSL 1.1.1

OpenSSL 1.0.2 から 1.0.2p

OpenSSL 1.1.0 から 1.1.0i

OpenSSL 1.1.1

Debian

Debian GNU/Linux

Canonical

Ubuntu

NetApp

CN1610 ファームウェア

NetApp Cloud Backup

NetApp OnCommand Unified Manager Core Package

SANtricity SMI-S Provider

SteelStore Cloud Integrated Storage

Node.js Foundation

Node.js

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-0734	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0734
2	CVE-2018-0734	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0734
National Vulnerability Database (NVD)
3	CVE-2018-0734	https://nvd.nist.gov/vuln/detail/CVE-2018-0734
4	CVE-2018-0734	https://nvd.nist.gov/vuln/detail/CVE-2018-0734

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-320	https://cwe.mitre.org/data/definitions/320.html
2	CWE-320	https://cwe.mitre.org/data/definitions/320.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-4348	https://www.debian.org/security/2018/dsa-4348
2	DSA-4348	https://www.debian.org/security/2018/dsa-4348
3	DSA-4355	https://www.debian.org/security/2018/dsa-4355
4	DSA-4355	https://www.debian.org/security/2018/dsa-4355
Git
5	Merge DSA reallocation timing fix CVE-2018-0734.	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=43e6a58d4991a451daf4891ff05a48735df871ac
6	Merge DSA reallocation timing fix CVE-2018-0734.	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=43e6a58d4991a451daf4891ff05a48735df871ac
7	Timing vulnerability in DSA signature generation (CVE-2018-0734).(8abfe)	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f
8	Timing vulnerability in DSA signature generation (CVE-2018-0734).(8abfe)	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8abfe72e8c1de1b95f50aa0d9134803b4d00070f
9	Timing vulnerability in DSA signature generation (CVE-2018-0734).(ef11e)	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7
10	Timing vulnerability in DSA signature generation (CVE-2018-0734).(ef11e)	https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ef11e19d1365eea2b1851e6f540a0bf365d303e7
NetApp Advisory
11	NTAP-20181105-0002	https://security.netapp.com/advisory/ntap-20181105-0002/
12	NTAP-20181105-0002	https://security.netapp.com/advisory/ntap-20181105-0002/
13	NTAP-20190118-0002	https://security.netapp.com/advisory/ntap-20190118-0002/
14	NTAP-20190118-0002	https://security.netapp.com/advisory/ntap-20190118-0002/
Node.js Foundation
15	November 2018 Security Releases	https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
16	November 2018 Security Releases	https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
OpenSSL Security Advisory
17	Timing vulnerability in DSA signature generation (CVE-2018-0734)	https://www.openssl.org/news/secadv/20181030.txt
18	Timing vulnerability in DSA signature generation (CVE-2018-0734)	https://www.openssl.org/news/secadv/20181030.txt
Ubuntu Security Notice
19	USN-3840-1	https://usn.ubuntu.com/3840-1/
20	USN-3840-1	https://usn.ubuntu.com/3840-1/

Change Log

No	Changed Details	Date of change
1	[2019年03月11日] 掲載	March 11, 2019, 2:01 p.m.

Configuration6	or higher	or less	more than	less than
cpe:2.3:a:netapp:cloud_backup:-:::::::*
cpe:2.3:a:netapp:oncommand_unified_manager::::::::
cpe:2.3:a:netapp:steelstore:-:::::::*
cpe:2.3:a:netapp:santricity_smi-s_provider:-:::::::*
cpe:2.3:a:netapp:snapcenter:-:::::::*
cpe:2.3:a:netapp:storage_automation_store:-:::::::*

Configuration7	or higher	or less	more than	less than
cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:::::::*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:::::::*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:::::::*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:::::::*
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:::::::*
cpe:2.3:a:oracle:mysql_enterprise_backup::::::::	3.0	3.12.3
cpe:2.3:a:oracle:mysql_enterprise_backup::::::::	4.0	4.1.2
cpe:2.3:a:oracle:primavera_p6_professional_project_management:15.2:::::::*
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.2.0.0.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_base_platform:12.1.0.5.0:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:18.8:::::::*
cpe:2.3:a:oracle:tuxedo:12.1.1.0.0:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:16.2:::::::*
cpe:2.3:a:oracle:e-business_suite_technology_stack:0.9.8:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:15.1:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management::::::::	17.7	17.12
cpe:2.3:a:oracle:e-business_suite_technology_stack:1.0.1:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:16.1:::::::*
cpe:2.3:a:oracle:e-business_suite_technology_stack:1.0.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0.0:::::::*
cpe:2.3:a:oracle:primavera_p6_professional_project_management:8.4:::::::*