Skip to content
Fencer Vulns
medium 5.3

CVE-2017-3735 json

While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread.

published 2017-08-28 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-12852

cvss
5.3
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
21.0%
EPSS 21.0% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.

Patch / fix

  • openssl Debian 14, Debian 13, Debian 12 1.1.0g-1

debian advisories DEBIAN-CVE-2017-3735

  • openssl Ubuntu 14.04 LTS 1.0.1f-1ubuntu2.23
  • openssl Ubuntu 16.04 LTS 1.0.2g-1ubuntu4.9
  • openssl Ubuntu 18.04 LTS 1.0.2g-1ubuntu14

ubuntu advisories UBUNTU-CVE-2017-3735

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl RHEL 7 1:1.0.2k-16.el7
  • openssl-libs RHEL 7 1:1.0.2k-16.el7
  • openssl-perl RHEL 7 1:1.0.2k-16.el7

red hat advisories RHSA-2018:3221

  • nodejs6 SLE Module for Web and Scripting 12, OpenStack Cloud 7, Enterprise Storage 4 6.12.2-11.8.1
  • nodejs4 SLE Module for Web and Scripting 12, Enterprise Storage 4 4.8.7-15.8.1
  • openssl SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +6 more 1.0.2j-60.16.1
  • openssl SLES for SAP 12 SP1, SLES 12 SP1-LTSS, OpenStack Cloud 6 1.0.1i-54.8.1
  • openssl1 SLES 11-SECURITY 1.0.1g-0.58.3.1
  • firefox-atk SLES 11 SP4-LTSS 2.26.1-2.8.4
  • mozilla-nss SLES 11 SP4-LTSS 3.45-38.9.3
  • firefox-gtk3 SLES 11 SP4-LTSS 3.10.9-2.15.3

suse advisories SUSE-SU-2019:14246-1SUSE-SU-2018:0293-1SUSE-SU-2018:0112-1SUSE-SU-2018:0002-1SUSE-SU-2017:3169-1SUSE-SU-2017:2981-1

  • openssl-1_0_0 openSUSE Tumbleweed 1.0.2u-6.2
  • openssl-1_1 openSUSE Tumbleweed 1.1.1l-1.2

opensuse advisories openSUSE-SU-2024:11126-1openSUSE-SU-2024:11127-1

  • openssl Alpine 3.8, Alpine 3.7, Alpine 3.6 +3 more 1.0.2m-r0

alpine advisories ALPINE-CVE-2017-3735

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl Arch Linux 1.1.0.g-1
  • lib32-openssl Arch Linux 1:1.1.0.g-1

arch linux advisories AVG-477AVG-478

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-3735 updated cvss 5.3

openssl: Malformed X.509 IPAdressFamily could cause OOB read

  • Red Hat Enterprise Linux 5 openssl, openssl097a Red Hat Enterprise Linux 6 openssl, openssl098e, openssl-perl Red Hat Enterprise Linux 7 OVMF, openssl098e Red Hat Enterprise Virtualization 3 mingw-virt-viewer, mingw32-virt-viewer, mingw64-virt-viewer Red Hat JBoss Core Services jbcs-httpd24-openssl Red Hat JBoss Enterprise Application Platform 5 openssl
    +4 more products
    Red Hat JBoss Enterprise Application Platform 6 openssl Red Hat JBoss Enterprise Web Server 1 openssl Red Hat JBoss Enterprise Web Server 2 openssl Red Hat JBoss Web Server 3 openssl
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7 Red Hat Enterprise Linux Client Optional (v. 7) openssl-perl 1.0.2k-16.el7 Red Hat Enterprise Linux ComputeNode (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-perl 1.0.2k-16.el7 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) openssl-perl 1.0.2k-16.el7
    +4 more products
    Red Hat Enterprise Linux Server (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7 Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl 1.0.2k-16.el7 Red Hat Enterprise Linux Workstation (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7 Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl 1.0.2k-16.el7
    fixed: vendor fix RHSA-2018:3221

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-076-01 updated cvss 5.3

CODESYS in Festo Automation Suite

  • CODESYS Development System 3.0 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138 CODESYS Development System 3.5.16.10 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138
    affected: mitigation
  • Festo Automation Suite 2.8.0.138 CODESYS Development System 3.5.21.20
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-273-04 updated cvss 5.3

Festo Controller CECC-S,-LK,-D Family Firmware (Update A)

  • Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-D (All versions) Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-S (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-LK (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-S (All versions)
    affected: mitigation “Festo has identified the following specific workarounds and mitigations users can apply to reduce risk:” certvde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-22-349-21 updated cvss 5.3

Siemens SCALANCE X-200RNA Switch Devices

  • Siemens SCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2) <V3.2.7 Siemens SCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2) <V3.2.7 Siemens SCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3) <V3.2.7 Siemens SCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3) <V3.2.7
    affected: fixed in V3.2.7, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-19-155-01 updated cvss 5.3

PHOENIX CONTACT PLCNext AXC F 2152

  • Phoenix Contact AXC F 2152 2404267 version 1.x, 1046568 (Starterkit) version 1.x
    affected: vendor fix, mitigation “Phoenix Contact recommends affected users update to firmware release 2019.0 LTS or later, update to PLCNext Engineer release 2019.0 LTS or later, and apply the following specific mitigations below:” phoenixcontact.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

cisa ICSA-19-024-02 updated cvss 5.3

PHOENIX CONTACT FL SWITCH

  • PHOENIX CONTACT, Innominate Security Technologies FL SWITCH 3xxx 4xxx and 48xx < 1.35
    affected: mitigation “Phoenix Contact also recommends that users using the Phoenix Contact managed FL SWITCH devices enable HTTP security.” cert.vde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

20.97% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • OpenSSL Software Foundation OpenSSL

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.