WaratekVRT Sign in

CVE-2018-0734 OpenSSL

Affected softwareOpenSSL
Severity5.9 Medium CVSS 3.1 2 scores
WeaknessCWE-327
Published30 Oct 2018
Updated8 Oct 2026

Description

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 8 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 12% chance in 30 days A model's forecast, not a report of exploitation. Higher than 96% of all scored CVEs.

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

5.9 MEDIUM v3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N NVD Primary published
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:P/I:N/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update January 2020 ↗ CPU 2020-Q1 Oracle Communications Applications / Security (OpenSSL) (7.5, 8.0, 8.1, 8.2, 8.3)
Oracle Communications Applications / Security (OpenSSL) (PCz3.0, PCz3.1, PCz3.2)
Oracle Critical Patch Update July 2019 ↗ CPU 2019-Q3 Oracle Fusion Middleware / Product Code (OpenSSL) (7.7.0)
Oracle Critical Patch Update April 2019 ↗ CPU 2019-Q2 Oracle Construction and Engineering Suite / Project Manager (OpenSSL) (8.4, 15.1, 15.2, 16.1, 16.2, 17.7-17.12, 18.8)
Oracle E-Business Suite / Technology Stack Triage (OpenSSL) (0.9.8, 1.0.0, 1.0.1)
Oracle Enterprise Manager Products Suite / Discovery Framework (OpenSSL) (12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0)
Oracle Enterprise Manager Products Suite / Networking (OpenSSL) (12.3.3)
Oracle Fusion Middleware / Oracle API Gateway (OpenSSL) (11.1.2.4.0)
Oracle Fusion Middleware / SSL/TLS (OpenSSL) (12.1.1.0.0)
Oracle MySQL / Enterprise Backup (OpenSSL) (3.12.3 and prior, 4.1.2 and prior)
Oracle PeopleSoft Products / Security (OpenSSL) (8.55, 8.56, 8.57)
Oracle Critical Patch Update January 2019 ↗ CPU 2019-Q1 Oracle MySQL / Server: Packaging (OpenSSL) (5.6.42 and prior, 5.7.24 and prior, 8.0.13 and prior)
Oracle Virtualization / Core (OpenSSL) (prior to 5.2.24, prior to 6.0.0)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications Security (OpenSSL) PCz3.0, PCz3.1, PCz3.2 7.5 · 8.0 · 8.1 · 8.2 · 8.3
Oracle Construction and Engineering Suite Project Manager (OpenSSL) 8.4, 15.1, 15.2, 16.1, 16.2, 17.7-17.12, 18.8 8.4 · 15.1 · 15.2 · 16.1 · 16.2 · 18.8
Oracle E-Business Suite Technology Stack Triage (OpenSSL) 0.9.8, 1.0.0, 1.0.1 0.9.8 · 1.0.0 · 1.0.1
Oracle Enterprise Manager Products Suite Discovery Framework (OpenSSL) 12.1.0.5.0, 13.2.0.0.0, 13.3.0.0.0 12.1.0.5.0 · 13.2.0.0.0 · 13.3.0.0.0
Oracle Enterprise Manager Products Suite Networking (OpenSSL) 12.3.3 12.3.3
Oracle Fusion Middleware Oracle API Gateway (OpenSSL) 11.1.2.4.0 11.1.2.4.0
Oracle Fusion Middleware Product Code (OpenSSL) 7.7.0 7.7.0
Oracle Fusion Middleware SSL/TLS (OpenSSL) 12.1.1.0.0 12.1.1.0.0
Oracle MySQL Enterprise Backup (OpenSSL) 3.12.3 and prior, 4.1.2 and prior
Oracle MySQL Server: Packaging (OpenSSL) 5.6.42 and prior, 5.7.24 and prior, 8.0.13 and prior
Oracle PeopleSoft Products Security (OpenSSL) 8.55, 8.56, 8.57 8.55 · 8.56 · 8.57
Oracle Virtualization Core (OpenSSL) prior to 5.2.24, prior to 6.0.0

Products and versions

19 products, 43 version entries
SourceVendorProductSchemeAffected versions
nvd canonical ubuntu linux generic 14.04 · 16.04 · 18.04 · 18.10
nvd debian debian linux generic 9.0
nvd netapp cloud backup generic any version
nvd netapp cn1610 firmware generic any version
nvd netapp oncommand unified manager generic any version
nvd netapp santricity smi-s provider generic any version
nvd netapp snapcenter generic any version
nvd netapp steelstore generic any version
nvd netapp storage automation store generic any version
nvd nodejs node.js generic ≥ 6.0.0 and ≤ 6.8.1 · ≥ 6.9.0 and ＜ 6.15.0 · ≥ 8.0.0 and ≤ 8.8.1 · ≥ 8.9.0 and ＜ 8.14.0 · ≥ 10.0.0 and ≤ 10.12.0 · 10.13.0 · ≥ 11.0.0 and ＜ 11.3.0
nvd openssl openssl generic ≥ 1.0.2 and ≤ 1.0.2 · ≥ 1.1.0 and ≤ 1.1.0 · 1.1.1
nvd oracle api gateway generic 11.1.2.4.0
nvd oracle e-business suite technology stack generic 0.9.8 · 1.0.0 · 1.0.1
nvd oracle enterprise manager base platform generic 12.1.0.5.0 · 13.2.0.0.0 · 13.3.0.0.0
nvd oracle enterprise manager ops center generic 12.3.3
nvd oracle mysql enterprise backup generic ≥ 3.0 and ≤ 3.12.3 · ≥ 4.0 and ≤ 4.1.2
nvd oracle peoplesoft enterprise peopletools generic 8.55 · 8.56 · 8.57
nvd oracle primavera p6 professional project management generic 8.4 · 15.1 · 15.2 · 16.1 · 16.2 · ≥ 17.7 and ≤ 17.12 · 18.8
nvd oracle tuxedo generic 12.1.1.0.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** ORACLE API GATEWAY (OPENSSL), MYSQL PROTOCOL, SSL/TLS (OPENSSL), SECURITY (OPENSSL), NO AUTH REMOTE EXPLOIT, NETWORKING (OPENSSL), DISCOVERY FRAMEWORK (OPENSSL), SERVER: PACKAGING (OPENSSL), PROJECT MANAGER (OPENSSL), TECHNOLOGY STACK TRIAGE (OPENSSL), HTTPS, CORE (OPENSSL), TLS, ENTERPRISE BACKUP (OPENSSL), PRODUCT CODE (OPENSSL) **Products:** ORACLE E-BUSINESS SUITE, PRIMAVERA P6 ENTERPRISE PROJECT PORTFOLIO MANAGEMENT, ORACLE CONSTRUCTION AND ENGINEERING SUITE, ORACLE VIRTUALIZATION, MYSQL ENTERPRISE BACKUP, ORACLE ENTERPRISE SESSION BORDER CONTROLLER, ORACLE FUSION MIDDLEWARE, ORACLE TUXEDO, ORACLE ENTERPRISE COMMUNICATIONS BROKER, ORACLE VM VIRTUALBOX, APPLICATION SERVER, ORACLE ENDECA SERVER, ORACLE MYSQL, ENTERPRISE MANAGER OPS CENTER, ORACLE PEOPLESOFT PRODUCTS, ORACLE API GATEWAY, ENTERPRISE MANAGER BASE PLATFORM, MYSQL SERVER, PEOPLESOFT ENTERPRISE PEOPLETOOLS, OPENSSL, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE ENTERPRISE MANAGER PRODUCTS SUITE

References

URLTags
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/105758 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:2304 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3700 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3932 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3933 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3935 Third Party Advisory
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=43e6a58d4991a451daf4891ff05a48735df871ac
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=8abfe72e8c1de1b95f50aa0d9134803b4d00070f

Timeline
Published2018-10-30By the CVE Program.
NVD record modified2026-10-08NVD's own last-modified date for this record.