CVE catalog

CVE-2017-3735

openssl: CVE-2017-3735

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
20.97% · Oct 25, 2026

While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopensslsid3.6.5-1fixed
Debianopensslforky3.6.5-1fixed
Debianopenssltrixie3.5.7-1~deb13u2fixed
Debianopenssltrixie-security3.5.7-1~deb13u3fixed
Debianopensslbookworm3.0.20-1~deb12u2fixed
Debianopensslbookworm-security3.0.22-1~deb12u2fixed
Alpineopenssl3.31.0.2m-r0fixed
Alpineopenssl3.41.0.2m-r0fixed
Alpineopenssl3.51.0.2m-r0fixed
Alpineopenssl3.61.0.2m-r0fixed
Alpineopenssl3.71.0.2m-r0fixed
Alpineopenssl3.81.0.2m-r0fixed
Ubuntuopenssl14.041.0.1e-3ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu2vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu3vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.3vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.5vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.7vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.8vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.11vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.12vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.15vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.16vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.17vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.18vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.19vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.20vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.21vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.22vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.23fixed
Ubuntuopenssl16.041.0.2d-0ubuntu1vulnerable
Ubuntuopenssl16.041.0.2d-0ubuntu2vulnerable
Ubuntuopenssl16.041.0.2e-1ubuntu1vulnerable
Ubuntuopenssl16.041.0.2f-2ubuntu1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu3vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.5vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.6vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.8vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.9fixed
Ubuntuopenssl18.041.0.2g-1ubuntu13vulnerable
Ubuntuopenssl18.041.0.2g-1ubuntu14fixed
Ubuntuopenssl14.041.0.1e-3ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu2vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu3vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.3vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.5vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.7vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.8vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.11vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.12vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.15vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.16vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.17vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.18vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.19vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.20vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.21vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.22vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.23fixed
Ubuntuopenssl16.041.0.2d-0ubuntu1vulnerable
Ubuntuopenssl16.041.0.2d-0ubuntu2vulnerable
Ubuntuopenssl16.041.0.2e-1ubuntu1vulnerable
Ubuntuopenssl16.041.0.2f-2ubuntu1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu3vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.5vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.6vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.8vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.9fixed
Suseopenssl1linux enterprise server 11-security1.0.1g-0.58.3.1fixed
Suseopenssllinux enterprise desktop 12 sp21.0.2j-60.16.1fixed
Suseopenssllinux enterprise desktop 12 sp31.0.2j-60.16.1fixed
Suseopenssllinux enterprise server for raspberry pi 12 sp21.0.2j-60.16.1fixed
Suseopenssllinux enterprise software development kit 12 sp21.0.2j-60.16.1fixed
Suseopenssllinux enterprise software development kit 12 sp31.0.2j-60.16.1fixed
Suseopenssllinux enterprise server 12 sp21.0.2j-60.16.1fixed
Suseopenssllinux enterprise server for sap applications 12 sp21.0.2j-60.16.1fixed
Suseopenssllinux enterprise server 12 sp31.0.2j-60.16.1fixed
Suseopenssllinux enterprise server for sap applications 12 sp31.0.2j-60.16.1fixed
Suseopensslopenstack cloud 61.0.1i-54.8.1fixed
Suseopenssllinux enterprise server for sap applications 12 sp11.0.1i-54.8.1fixed
Suseopenssllinux enterprise server 12 sp1-ltss1.0.1i-54.8.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopensslsourcesid1.1.0g-1not yet assignedNot reportedNot reported
Debianopensslsourceforky1.1.0g-1not yet assignedNot reportedNot reported
Debianopensslsourcetrixie1.1.0g-1not yet assignedNot reportedNot reported
Debianopensslsourcebookworm1.1.0g-1not yet assignedNot reportedNot reported
Alpineopensslapk3.31.0.2m-r0Not reportedALPINE-CVE-2017-3735Not reported
Alpineopensslapk3.41.0.2m-r0Not reportedALPINE-CVE-2017-3735Not reported
Alpineopensslapk3.51.0.2m-r0Not reportedALPINE-CVE-2017-3735Not reported
Alpineopensslapk3.61.0.2m-r0Not reportedALPINE-CVE-2017-3735Not reported
Alpineopensslapk3.71.0.2m-r0Not reportedALPINE-CVE-2017-3735Not reported
Alpineopensslapk3.81.0.2m-r0Not reportedALPINE-CVE-2017-3735Not reported
Ubuntuopenssldeb14.041.0.1f-1ubuntu2.23Not reportedUBUNTU-CVE-2017-3735Not reported
Ubuntuopenssldeb16.041.0.2g-1ubuntu4.9Not reportedUBUNTU-CVE-2017-3735Not reported
Ubuntuopenssldeb18.041.0.2g-1ubuntu14Not reportedUBUNTU-CVE-2017-3735Not reported
Ubuntuopenssldeb14.041.0.1f-1ubuntu2.23Not reportedUSN-3475-1Not reported
Ubuntuopenssldeb16.041.0.2g-1ubuntu4.9Not reportedUSN-3475-1Not reported
Suseopenssl1rpmlinux enterprise server 11-security1.0.1g-0.58.3.1Not reportedSUSE-SU-2017:2968-1Not reported
Suseopensslrpmlinux enterprise desktop 12 sp21.0.2j-60.16.1Not reportedSUSE-SU-2017:3169-1Not reported
Suseopensslrpmlinux enterprise desktop 12 sp31.0.2j-60.16.1Not reportedSUSE-SU-2017:3169-1Not reported
Suseopensslrpmlinux enterprise server for raspberry pi 12 sp21.0.2j-60.16.1Not reportedSUSE-SU-2017:3169-1Not reported
Suseopensslrpmlinux enterprise software development kit 12 sp21.0.2j-60.16.1Not reportedSUSE-SU-2017:3169-1Not reported
Suseopensslrpmlinux enterprise software development kit 12 sp31.0.2j-60.16.1Not reportedSUSE-SU-2017:3169-1Not reported
Suseopensslrpmlinux enterprise server 12 sp21.0.2j-60.16.1Not reportedSUSE-SU-2017:3169-1Not reported
Suseopensslrpmlinux enterprise server for sap applications 12 sp21.0.2j-60.16.1Not reportedSUSE-SU-2017:3169-1Not reported
Suseopensslrpmlinux enterprise server 12 sp31.0.2j-60.16.1Not reportedSUSE-SU-2017:3169-1Not reported
Suseopensslrpmlinux enterprise server for sap applications 12 sp31.0.2j-60.16.1Not reportedSUSE-SU-2017:3169-1Not reported
Suseopensslrpmopenstack cloud 61.0.1i-54.8.1Not reportedSUSE-SU-2017:2981-1Not reported
Suseopensslrpmlinux enterprise server for sap applications 12 sp11.0.1i-54.8.1Not reportedSUSE-SU-2017:2981-1Not reported
Suseopensslrpmlinux enterprise server 12 sp1-ltss1.0.1i-54.8.1Not reportedSUSE-SU-2017:2981-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libssl3]Unknown

    Source package: [openssl]

    Details (6)
    • 3.0.20-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · amd64 · bookworm-updates

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · arm64 · bookworm-updates

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

  • [libssl-dev]Unknown

    Source package: [openssl]

    Details (6)
    • 3.0.20-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · amd64 · bookworm-updates

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · arm64 · bookworm-updates

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

  • [libssl-doc]Unknown

    Source package: [openssl]

    Details (6)
    • 3.0.20-1~deb12u2 · all · bookworm

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · all · bookworm

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · all · bookworm-updates

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · all · bookworm-updates

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

  • [openssl]Unknown
    Details (6)
    • 3.0.20-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · amd64 · bookworm-updates

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · arm64 · bookworm-updates

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

[Debian 13 (Trixie)]

  • [libssl3t64]Unknown

    Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

  • [libssl-dev]Unknown

    Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

  • [libssl-doc]Unknown

    Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · all · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · all · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · all · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · all · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · all · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · all · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

  • [openssl]Unknown
    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

  • Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

  • Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.1.0g-1

      dsa · openssl · debian · 13

Observed:

References