ALPINE-CVE-2018-0735 PUBLISHED CVSS 5.900000095367432 MEDIUM

The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).

Risk Scores

CVSS v3.1
5.900000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products

VendorProductVersions
Alpine:v3.20nodejs4.4.4-r0, 4.4.7-r0, 6.9.4-r1
Alpine:v3.9openssl0, 1.1.1-r3, 1.1.1-r4
Alpine:v3.17openssl1.1.1-r5, 1.1.1-r4, 0
Alpine:v3.23nodejs0, 0, 0
Alpine:v3.10openssl0, 1.1.1-r2, 1.1.1-r3
Alpine:v3.19openssl1.1.1-r0, 1.1.1-r5, 0
Alpine:v3.12nodejs8.11.3-r0, 0, 10.13.0-r0
Alpine:v3.19nodejs6.11.1-r0, 6.10.3-r0, 6.10.1-r0
Alpine:v3.13openssl1.1.1-r1, 1.1.1-r2, 1.1.1-r3
Alpine:v3.23openssl1.1.1-r0, 1.1.1-r5, 1.1.1-r4
Alpine:v3.14openssl1.1.1-r5, 0, 1.1.1-r1
Alpine:v3.15openssl31.1.1-r3, 1.1.1-r2, 1.1.1-r1
Alpine:v3.17nodejs8.9.3-r1, 8.9.4-r0, 6.10.3-r0
Alpine:v3.15openssl0, 0, 0
Alpine:v3.22openssl1.1.1-r2, 1.1.1-r1, 1.1.1-r2
Alpine:v3.12openssl1.1.1-r2, 1.1.1-r3, 1.1.1-r5
Alpine:v3.11nodejs8.9.4-r0, 8.9.3-r1, 8.9.3-r0
Alpine:v3.21openssl1.1.1-r1, 1.1.1-r3, 1.1.1-r2
Alpine:v3.16openssl0, 0, 0
Alpine:v3.13nodejs4.4.3-r0, 10.13.0-r0, 4.4.3-r0

…and 12 more

Timeline

References

Open in Interactive Console →