CVE catalog

CVE-2018-0737

openssl: CVE-2018-0737

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
11.60% · Oct 25, 2026

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopensslsid3.6.5-1fixed
Debianopensslforky3.6.5-1fixed
Debianopenssltrixie3.5.7-1~deb13u2fixed
Debianopenssltrixie-security3.5.7-1~deb13u3fixed
Debianopensslbookworm3.0.20-1~deb12u2fixed
Debianopensslbookworm-security3.0.22-1~deb12u2fixed
CpeopensslNot reportedNot reportedunknown
Cpeubuntu_linuxNot reportedNot reportedunknown
Alpineopenssl3.31.0.2o-r1fixed
Alpineopenssl3.41.0.2o-r2fixed
Alpineopenssl3.51.0.2o-r1fixed
Alpineopenssl3.61.0.2o-r1fixed
Alpineopenssl3.71.0.2o-r1fixed
Alpineopenssl3.81.0.2o-r2fixed
Ubuntuopenssl14.041.0.1e-3ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu2vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu3vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.3vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.5vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.7vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.8vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.11vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.12vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.15vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.16vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.17vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.18vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.19vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.20vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.21vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.22vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.23vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.24vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.25vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.26fixed
Ubuntuopenssl16.041.0.2d-0ubuntu1vulnerable
Ubuntuopenssl16.041.0.2d-0ubuntu2vulnerable
Ubuntuopenssl16.041.0.2e-1ubuntu1vulnerable
Ubuntuopenssl16.041.0.2f-2ubuntu1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu3vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.5vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.6vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.8vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.9vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.10vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.11vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.12vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.13fixed
Ubuntuopenssl18.041.0.2g-1ubuntu13vulnerable
Ubuntuopenssl18.041.0.2g-1ubuntu14vulnerable
Ubuntuopenssl18.041.0.2n-1ubuntu1vulnerable
Ubuntuopenssl18.041.1.0g-2ubuntu1vulnerable
Ubuntuopenssl18.041.1.0g-2ubuntu2vulnerable
Ubuntuopenssl18.041.1.0g-2ubuntu3vulnerable
Ubuntuopenssl18.041.1.0g-2ubuntu4vulnerable
Ubuntuopenssl18.041.1.0g-2ubuntu4.1fixed
Ubuntuopenssl1.018.041.0.2n-1ubuntu2vulnerable
Ubuntuopenssl1.018.041.0.2n-1ubuntu3vulnerable
Ubuntuopenssl1.018.041.0.2n-1ubuntu4vulnerable
Ubuntuopenssl1.018.041.0.2n-1ubuntu5vulnerable
Ubuntuopenssl1.018.041.0.2n-1ubuntu5.1fixed
Ubuntuopenssl14.041.0.1e-3ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu2vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu3vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.3vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.5vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.7vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.8vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.11vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.12vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.15vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.16vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.17vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.18vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.19vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.20vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.21vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.22vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.23vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.24vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.25fixed
Ubuntuopenssl16.041.0.2d-0ubuntu1vulnerable
Ubuntuopenssl16.041.0.2d-0ubuntu2vulnerable
Ubuntuopenssl16.041.0.2e-1ubuntu1vulnerable
Ubuntuopenssl16.041.0.2f-2ubuntu1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu3vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.5vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.6vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.8vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.9vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.10vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.11vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.12fixed
Suseopensslopenstack cloud 71.0.2j-60.39.1fixed
Suseopenssllinux enterprise desktop 12 sp31.0.2j-60.39.1fixed
Suseopenssllinux enterprise server for sap applications 12 sp21.0.2j-60.39.1fixed
Suseopenssllinux enterprise software development kit 12 sp31.0.2j-60.39.1fixed
Suseopenssllinux enterprise server 12 sp2-ltss1.0.2j-60.39.1fixed
Suseopenssllinux enterprise server 12 sp31.0.2j-60.39.1fixed
Suseopenssllinux enterprise server for sap applications 12 sp31.0.2j-60.39.1fixed
Suseopensslenterprise storage 41.0.2j-60.39.1fixed
Suseopenssllinux enterprise server 12 sp2-bcl1.0.2j-60.39.1fixed
Suseopenssllinux enterprise server for sap applications 12 sp11.0.1i-54.17.1fixed
Suseopenssllinux enterprise server 12 sp1-ltss1.0.1i-54.17.1fixed
Opensuseopenssl-1_1leap 15.01.1.0i-lp150.3.18.1fixed
Suseopenssllinux enterprise software development kit 11 sp40.9.8j-0.106.15.1fixed
Suseopenssllinux enterprise server 11 sp40.9.8j-0.106.15.1fixed
Suseopenssllinux enterprise server for sap applications 11 sp40.9.8j-0.106.15.1fixed
Suseopensslstudio onsite 1.30.9.8j-0.106.15.1fixed
Suseopenssl-1_1linux enterprise module for basesystem 151.1.0i-4.18.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopensslsourcesid1.1.0h-3lowNot reported[895844]
Debianopensslsourceforky1.1.0h-3lowNot reported[895844]
Debianopensslsourcetrixie1.1.0h-3lowNot reported[895844]
Debianopensslsourcebookworm1.1.0h-3lowNot reported[895844]
Alpineopensslapk3.31.0.2o-r1Not reportedALPINE-CVE-2018-0737Not reported
Alpineopensslapk3.41.0.2o-r2Not reportedALPINE-CVE-2018-0737Not reported
Alpineopensslapk3.51.0.2o-r1Not reportedALPINE-CVE-2018-0737Not reported
Alpineopensslapk3.61.0.2o-r1Not reportedALPINE-CVE-2018-0737Not reported
Alpineopensslapk3.71.0.2o-r1Not reportedALPINE-CVE-2018-0737Not reported
Alpineopensslapk3.81.0.2o-r2Not reportedALPINE-CVE-2018-0737Not reported
Ubuntuopenssldeb14.041.0.1f-1ubuntu2.26Not reportedUBUNTU-CVE-2018-0737Not reported
Ubuntuopenssldeb16.041.0.2g-1ubuntu4.13Not reportedUBUNTU-CVE-2018-0737Not reported
Ubuntuopenssldeb18.041.1.0g-2ubuntu4.1Not reportedUBUNTU-CVE-2018-0737Not reported
Ubuntuopenssl1.0deb18.041.0.2n-1ubuntu5.1Not reportedUBUNTU-CVE-2018-0737Not reported
Ubuntuopenssldeb14.041.0.1f-1ubuntu2.25Not reportedUSN-3628-1Not reported
Ubuntuopenssldeb16.041.0.2g-1ubuntu4.12Not reportedUSN-3628-1Not reported
Suseopensslrpmopenstack cloud 71.0.2j-60.39.1Not reportedSUSE-SU-2018:2928-1Not reported
Suseopensslrpmlinux enterprise desktop 12 sp31.0.2j-60.39.1Not reportedSUSE-SU-2018:2928-1Not reported
Suseopensslrpmlinux enterprise server for sap applications 12 sp21.0.2j-60.39.1Not reportedSUSE-SU-2018:2928-1Not reported
Suseopensslrpmlinux enterprise software development kit 12 sp31.0.2j-60.39.1Not reportedSUSE-SU-2018:2928-1Not reported
Suseopensslrpmlinux enterprise server 12 sp2-ltss1.0.2j-60.39.1Not reportedSUSE-SU-2018:2928-1Not reported
Suseopensslrpmlinux enterprise server 12 sp31.0.2j-60.39.1Not reportedSUSE-SU-2018:2928-1Not reported
Suseopensslrpmlinux enterprise server for sap applications 12 sp31.0.2j-60.39.1Not reportedSUSE-SU-2018:2928-1Not reported
Suseopensslrpmenterprise storage 41.0.2j-60.39.1Not reportedSUSE-SU-2018:2928-1Not reported
Suseopensslrpmlinux enterprise server 12 sp2-bcl1.0.2j-60.39.1Not reportedSUSE-SU-2018:2928-2Not reported
Suseopensslrpmlinux enterprise server for sap applications 12 sp11.0.1i-54.17.1Not reportedSUSE-SU-2018:2492-1Not reported
Suseopensslrpmlinux enterprise server 12 sp1-ltss1.0.1i-54.17.1Not reportedSUSE-SU-2018:2492-1Not reported
Opensuseopenssl-1_1rpmleap 15.01.1.0i-lp150.3.18.1Not reportedOPENSUSE-SU-2019:0152-1Not reported
Suseopensslrpmlinux enterprise software development kit 11 sp40.9.8j-0.106.15.1Not reportedSUSE-SU-2018:2486-1Not reported
Suseopensslrpmlinux enterprise server 11 sp40.9.8j-0.106.15.1Not reportedSUSE-SU-2018:2486-1Not reported
Suseopensslrpmlinux enterprise server for sap applications 11 sp40.9.8j-0.106.15.1Not reportedSUSE-SU-2018:2486-1Not reported
Suseopensslrpmstudio onsite 1.30.9.8j-0.106.15.1Not reportedSUSE-SU-2018:2486-1Not reported
Suseopenssl-1_1rpmlinux enterprise module for basesystem 151.1.0i-4.18.1Not reportedSUSE-SU-2019:0197-1Not reported

[Debian bug #895844]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libssl3]Unknown

    Source package: [openssl]

    Details (6)
    • 3.0.20-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.17-1~deb12u2 · amd64 · bookworm-updates

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.17-1~deb12u2 · arm64 · bookworm-updates

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

  • [libssl-dev]Unknown

    Source package: [openssl]

    Details (6)
    • 3.0.20-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.17-1~deb12u2 · amd64 · bookworm-updates

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.17-1~deb12u2 · arm64 · bookworm-updates

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

  • [libssl-doc]Unknown

    Source package: [openssl]

    Details (6)
    • 3.0.20-1~deb12u2 · all · bookworm

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · all · bookworm

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.17-1~deb12u2 · all · bookworm-updates

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.17-1~deb12u2 · all · bookworm-updates

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

  • [openssl]Unknown
    Details (6)
    • 3.0.20-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.20-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.17-1~deb12u2 · amd64 · bookworm-updates

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

    • 3.0.17-1~deb12u2 · arm64 · bookworm-updates

      Fixed · Fixed: 1.1.0h-3

      dsa · openssl · debian · bookworm

Observed:

References