{"id":"CVE-2017-3731","published":"2017-05-04T19:00:00Z","modified":"2024-09-16T22:40:54Z","title":"Truncated packet could crash via OOB read","vendor":"OpenSSL","product":"OpenSSL","tier":"core","eol":null,"affectedVersions":[{"vendor":"OpenSSL","product":"OpenSSL","versions":["openssl-1.1.0","openssl-1.1.0a","openssl-1.1.0b","openssl-1.1.0c","openssl-1.0.2","openssl-1.0.2a","openssl-1.0.2b","openssl-1.0.2c","openssl-1.0.2d","openssl-1.0.2e"]}],"description":{"text":"If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k.","provenance":"source","from":"CVE.org"},"summary":{"text":"A truncated packet flaw in OpenSSL allows an out-of-bounds read in SSL/TLS servers and clients running on 32-bit hosts when a specific cipher is in use, typically causing a crash. Triggering it requires only that the affected cipher (CHACHA20/POLY1305 in OpenSSL 1.1.0, or RC4-MD5 in 1.0.2) is negotiated, with no stated authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:24:01Z"},"cvss":null,"epss":{"score":0.57322,"percentile":0.99072,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:2185","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2186","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://security.netapp.com/advisory/ntap-20171019-0002/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/95813","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0286.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc","tags":["vendor-advisory","x_refsource_FREEBSD"]},{"url":"https://www.openssl.org/news/secadv/20170126.txt","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1037717","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM"]},{"url":"https://www.tenable.com/security/tns-2017-04","tags":["x_refsource_CONFIRM"]},{"url":"https://source.android.com/security/bulletin/pixel/2017-11-01","tags":["x_refsource_CONFIRM"]},{"url":"https://security.gentoo.org/glsa/201702-07","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.debian.org/security/2017/dsa-3773","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2187","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html","tags":["x_refsource_MISC"]},{"url":"https://security.paloaltonetworks.com/CVE-2017-3731","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-12848","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-12848","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2017-05-04","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2017-3731","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.81,"detail":"percentile 0.9907"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}