Skip to content
Fencer Vulns
medium 6.5

CVE-2018-0739 json

Constructed ASN.1 types with a recursive definition could exceed the stack

published 2018-03-27 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1549

cvss
6.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
18.6%
EPSS 18.6% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

Patch / fix

  • openssl Debian 14, Debian 13, Debian 12 1.1.0h-1
  • libtomcrypt Debian 14, Debian 13, Debian 12 1.18.2-1

debian advisories DEBIAN-CVE-2018-0739

  • openssl Ubuntu 14.04 LTS 1.0.1f-1ubuntu2.24
  • openssl Ubuntu 16.04 LTS 1.0.2g-1ubuntu4.11
  • openssl Ubuntu 18.04 LTS 1.1.0g-2ubuntu3
  • openssl1.0 Ubuntu 18.04 LTS 1.0.2n-1ubuntu5

ubuntu advisories UBUNTU-CVE-2018-0739

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl RHEL 7 1:1.0.2k-16.el7
  • openssl-libs RHEL 7 1:1.0.2k-16.el7
  • openssl-perl RHEL 7 1:1.0.2k-16.el7
  • tomcat7 jboss enterprise web server 3.1 7.0.70-34.ep7.el6
  • tomcat7 jboss enterprise web server 3.1 7.0.70-34.ep7.el7
  • tomcat8 jboss enterprise web server 3.1 8.0.36-39.ep7.el6
  • tomcat8 jboss enterprise web server 3.1 8.0.36-39.ep7.el7
  • tomcat7-lib jboss enterprise web server 3.1 7.0.70-34.ep7.el6

red hat advisories RHSA-2018:3221RHSA-2019:1711RHSA-2019:0367RHSA-2018:3090

  • ovmf SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +1 more 2015+git1462940744.321151f-19.10.3
  • compat-openssl098 SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for SAP 12 SP1 +2 more 0.9.8j-106.6.1
  • ovmf SLES for SAP 12 SP3, SLES 12 SP3 2017+git1492060560.b6d11d7c46-4.9.4
  • ovmf SLE Module for Server Applications 15 2017+git1510945757.b2662641d5-5.3.6
  • openssl Studio Onsite 1.3, SLES for SAP 11 SP4, SLES 11 SP4 +1 more 0.9.8j-0.106.9.1
  • openssl SLES for SAP 12 SP3, SLES for SAP 12 SP2, SLES for Raspberry Pi 12 SP2 +6 more 1.0.2j-60.24.1
  • openssl1 SLES 11-SECURITY 1.0.1g-0.58.9.1
  • openssl SLES for SAP 12 SP1, SLES 12 SP1-LTSS, OpenStack Cloud 6 1.0.1i-54.11.1

suse advisories SUSE-SU-2020:0495-1SUSE-SU-2018:2683-1SUSE-SU-2018:2534-1SUSE-SU-2018:2158-1SUSE-SU-2018:2072-1SUSE-SU-2018:0975-1

  • openssl-1_0_0 openSUSE Tumbleweed 1.0.2u-6.2
  • openssl-1_1 openSUSE Tumbleweed 1.1.1l-1.2
  • ovmf openSUSE Tumbleweed 202105-3.4
  • virtualbox openSUSE Tumbleweed 6.1.26-3.2

opensuse advisories openSUSE-SU-2024:11126-1openSUSE-SU-2024:11127-1openSUSE-SU-2024:11134-1openSUSE-SU-2024:11501-1

  • openssl Alpine 3.8, Alpine 3.7, Alpine 3.6 +3 more 1.0.2o-r0

alpine advisories ALPINE-CVE-2018-0739

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openssl Arch Linux 1.1.0.h-1

arch linux advisories AVG-540

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-0739 updated cvss 6.5

openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service

  • Red Hat Enterprise Linux 5 openssl, openssl097a
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 6 openssl, openssl098e, openssl-perl Red Hat Enterprise Linux 7 OVMF, openssl098e Red Hat JBoss Enterprise Application Platform 5 openssl Red Hat JBoss Enterprise Application Platform 6 openssl Red Hat JBoss Enterprise Web Server 2 openssl
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7 Red Hat Enterprise Linux Client Optional (v. 7) openssl-perl 1.0.2k-16.el7 Red Hat Enterprise Linux ComputeNode (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7 Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-perl 1.0.2k-16.el7 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) openssl-perl 1.0.2k-16.el7, ovmf 20180508-3.gitee3198e672e2.el7, AAVMF 20180508-3.gitee3198e672e2.el7
    +4 more products
    Red Hat Enterprise Linux Server (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7, ovmf 20180508-3.gitee3198e672e2.el7, OVMF 20180508-3.gitee3198e672e2.el7 Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl 1.0.2k-16.el7 Red Hat Enterprise Linux Workstation (v. 7) openssl 1.0.2k-16.el7, openssl-libs 1.0.2k-16.el7 Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl 1.0.2k-16.el7
    fixed: vendor fix RHSA-2018:3221
  • Red Hat JBoss Core Services
    fixed: vendor fix RHSA-2019:0366
  • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24 1-6.jbcs.el6, jbcs-httpd24-runtime 1-6.jbcs.el6, jbcs-httpd24-apr 1.6.3-31.jbcs.el6, jbcs-httpd24-httpd 2.4.29-35.jbcs.el6, jbcs-httpd24-nghttp2 1.29.0-9.jbcs.el6, jbcs-httpd24-apr-util 1.6.1-24.jbcs.el6, +22 more Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24 1-6.jbcs.el7, jbcs-httpd24-runtime 1-6.jbcs.el7, jbcs-httpd24-apr 1.6.3-31.jbcs.el7, jbcs-httpd24-httpd 2.4.29-35.jbcs.el7, jbcs-httpd24-nghttp2 1.29.0-9.jbcs.el7, jbcs-httpd24-apr-util 1.6.1-24.jbcs.el7, +22 more
    fixed: vendor fix RHSA-2019:0367
  • Red Hat JBoss Web Server 3.1
    fixed: vendor fix RHSA-2019:1712
  • Red Hat JBoss Web Server 3.1 for RHEL 6 tomcat7 7.0.70-34.ep7.el6, tomcat8 8.0.36-39.ep7.el6, tomcat7-lib 7.0.70-34.ep7.el6, tomcat8-lib 8.0.36-39.ep7.el6, tomcat7-jsvc 7.0.70-34.ep7.el6, tomcat8-jsvc 8.0.36-39.ep7.el6, +19 more Red Hat JBoss Web Server 3.1 for RHEL 7 tomcat7 7.0.70-34.ep7.el7, tomcat8 8.0.36-39.ep7.el7, tomcat7-lib 7.0.70-34.ep7.el7, tomcat8-lib 8.0.36-39.ep7.el7, tomcat7-jsvc 7.0.70-34.ep7.el7, tomcat8-jsvc 8.0.36-39.ep7.el7, +19 more
    fixed: vendor fix RHSA-2019:1711
  • Red Hat Enterprise Linux 8 openssl, openssl-libs, openssl-perl
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-076-01 updated cvss 6.5

CODESYS in Festo Automation Suite

  • CODESYS Development System 3.0 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138 CODESYS Development System 3.5.16.10 Festo Automation Suite 2.8.0.137, Festo Automation Suite < 2.8.0.138
    affected: mitigation
  • Festo Automation Suite 2.8.0.138 CODESYS Development System 3.5.21.20
    fixed

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-273-04 updated cvss 6.5

Festo Controller CECC-S,-LK,-D Family Firmware (Update A)

  • Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-D (All versions) Festo Firmware (R05 (17.06.2016) = 2.3.8.0) installed on Festo Hardware Controller CECC-S (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-LK (All versions) Festo Firmware (R06 (11.10.2016) = 2.3.8.1) installed on Festo Hardware Controller CECC-S (All versions)
    affected: mitigation “Festo has identified the following specific workarounds and mitigations users can apply to reduce risk:” certvde.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

18.60% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

  • OpenSSL OpenSSL

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.