CVE-2018-0733 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2018-0733 Interim 1 18 2023-02-10T02:01:23Z current 2021-05-30T14:06:38Z 2023-02-10T02:01:23Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2018-0733 Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings Magnum Orchestration 7 SUSE Container as a Service Platform 2.0 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Server 11 SP1 for Teradata SUSE Linux Enterprise Server 11 SP3 LTSS SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Server 11 SP4-LTSS SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE Studio Onsite 1.3 libopenssl-devel libopenssl0_9_8 libopenssl0_9_8-32bit libopenssl0_9_8-hmac libopenssl0_9_8-hmac-32bit libopenssl1_0_0 libopenssl1_0_0-32bit libopenssl1_0_0-hmac libopenssl1_0_0-hmac-32bit openssl openssl-doc openssl as a component of Magnum Orchestration 7 openssl as a component of SUSE Container as a Service Platform 2.0 libopenssl-devel as a component of SUSE Linux Enterprise Desktop 12 SP3 libopenssl1_0_0 as a component of SUSE Linux Enterprise Desktop 12 SP3 libopenssl1_0_0-32bit as a component of SUSE Linux Enterprise Desktop 12 SP3 openssl as a component of SUSE Linux Enterprise Desktop 12 SP3 openssl as a component of SUSE Linux Enterprise Server 11 SP1 for Teradata openssl as a component of SUSE Linux Enterprise Server 11 SP3 LTSS openssl as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata libopenssl0_9_8 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libopenssl0_9_8-32bit as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libopenssl0_9_8-hmac as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libopenssl0_9_8-hmac-32bit as a component of SUSE Linux Enterprise Server 11 SP4-LTSS openssl as a component of SUSE Linux Enterprise Server 11 SP4-LTSS openssl-doc as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libopenssl-devel as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0 as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-32bit as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-hmac as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-hmac-32bit as a component of SUSE Linux Enterprise Server 12 SP2 openssl as a component of SUSE Linux Enterprise Server 12 SP2 openssl-doc as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl-devel as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-32bit as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-hmac as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-hmac-32bit as a component of SUSE Linux Enterprise Server 12 SP3 openssl as a component of SUSE Linux Enterprise Server 12 SP3 openssl-doc as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl-devel as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 openssl as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 libopenssl-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 openssl as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libopenssl-devel as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 openssl as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 openssl as a component of SUSE Studio Onsite 1.3 Because of an implementation bug the PA-RISC CRYPTO_memcmp function is effectively reduced to only comparing the least significant bit of each byte. This allows an attacker to forge messages that would be considered as authenticated in an amount of tries lower than that guaranteed by the security claims of the scheme. The module can only be compiled by the HP-UX assembler, so that only HP-UX PA-RISC targets are affected. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). CVE-2018-0733 Magnum Orchestration 7:openssl SUSE Container as a Service Platform 2.0:openssl SUSE Linux Enterprise Desktop 12 SP3:libopenssl-devel SUSE Linux Enterprise Desktop 12 SP3:libopenssl1_0_0 SUSE Linux Enterprise Desktop 12 SP3:libopenssl1_0_0-32bit SUSE Linux Enterprise Desktop 12 SP3:openssl SUSE Linux Enterprise Server 11 SP1 for Teradata:openssl SUSE Linux Enterprise Server 11 SP3 LTSS:openssl SUSE Linux Enterprise Server 11 SP3 for Teradata:openssl SUSE Linux Enterprise Server 11 SP4-LTSS:libopenssl0_9_8 SUSE Linux Enterprise Server 11 SP4-LTSS:libopenssl0_9_8-32bit SUSE Linux Enterprise Server 11 SP4-LTSS:libopenssl0_9_8-hmac SUSE Linux Enterprise Server 11 SP4-LTSS:libopenssl0_9_8-hmac-32bit SUSE Linux Enterprise Server 11 SP4-LTSS:openssl SUSE Linux Enterprise Server 11 SP4-LTSS:openssl-doc SUSE Linux Enterprise Server 12 SP2:libopenssl-devel SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0 SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-32bit SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-hmac SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-hmac-32bit SUSE Linux Enterprise Server 12 SP2:openssl SUSE Linux Enterprise Server 12 SP2:openssl-doc SUSE Linux Enterprise Server 12 SP3:libopenssl-devel SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0 SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-32bit SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-hmac SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-hmac-32bit SUSE Linux Enterprise Server 12 SP3:openssl SUSE Linux Enterprise Server 12 SP3:openssl-doc SUSE Linux Enterprise Software Development Kit 11 SP4:libopenssl-devel SUSE Linux Enterprise Software Development Kit 11 SP4:openssl SUSE Linux Enterprise Software Development Kit 12 SP2:libopenssl-devel SUSE Linux Enterprise Software Development Kit 12 SP2:openssl SUSE Linux Enterprise Software Development Kit 12 SP3:libopenssl-devel SUSE Linux Enterprise Software Development Kit 12 SP3:openssl SUSE Studio Onsite 1.3:openssl moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N