{"id":"CVE-2017-3733","details":"During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL 1.1.0 before 1.1.0e to crash (dependent on ciphersuite). Both clients and servers are affected.","modified":"2026-07-08T11:35:53.067826Z","published":"2017-05-04T19:29:00.430Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:hp:operations_agent:11.14:*:*:*:*:*:*:*","cpe:2.3:a:hp:operations_agent:11.15:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11.14"},{"last_affected":"11.14"},{"introduced":"11.15"},{"last_affected":"11.15"}],"source":"CPE_STRING","vendor_product":"hp:operations_agent"}]},"references":[{"type":"WEB","url":"http://www.securitytracker.com/id/1037846"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/96269"},{"type":"ADVISORY","url":"https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03728en_us"},{"type":"ADVISORY","url":"https://www.openssl.org/news/secadv/20170216.txt"},{"type":"ADVISORY","url":"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"},{"type":"FIX","url":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openssl/openssl","events":[{"introduced":"7ea5bd2b52d0e81eaef3d109b3b12545306f201c"},{"last_affected":"7ea5bd2b52d0e81eaef3d109b3b12545306f201c"},{"fixed":"4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2"}],"database_specific":{"extracted_events":[{"introduced":"1.1.0"},{"last_affected":"1.1.0"},{"introduced":"1.1.0a"},{"last_affected":"1.1.0a"},{"introduced":"1.1.0b"},{"last_affected":"1.1.0b"},{"introduced":"1.1.0c"},{"last_affected":"1.1.0c"},{"introduced":"1.1.0d"},{"last_affected":"1.1.0d"}],"source":["CPE_STRING","REFERENCES"],"cpe":["cpe:2.3:a:openssl:openssl:1.1.0:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.0a:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.0b:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.0c:*:*:*:*:*:*:*","cpe:2.3:a:openssl:openssl:1.1.0d:*:*:*:*:*:*:*"]}}],"versions":["1.1.0","OpenSSL_1_1_0l"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-3733.json","vanir_signatures_modified":"2026-07-08T11:35:53Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/t1_lib.c","function":"ssl_add_serverhello_tlsext"},"deprecated":false,"digest":{"function_hash":"291408060013259910944255651829066663698","length":5638},"id":"CVE-2017-3733-3c16f3a1"},{"deprecated":false,"digest":{"line_hashes":["210326899922277202621865221518711144115","297451899453299258081107901935296450843","28043226173519611562756266551699631673","239950022388405435006885238396795129531","298807974921422794162263307456272928810","275572865100524505798724938797157627264","323525093030425060433573353002573913850","299219773649024902964080869335264160673","306890453261393261459494927338753721926","235017954287774655309541109400404464721","183465734327004646886910361269819978850","175708054807709914081093413817516278625","169233866011009153720796270666979617551","193346602038903284457999880423246648703"],"threshold":0.9},"id":"CVE-2017-3733-572f8a24","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/t1_enc.c"}},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/t1_lib.c","function":"ssl_scan_serverhello_tlsext"},"deprecated":false,"digest":{"length":6972,"function_hash":"226713604719132484728676348123942863499"},"id":"CVE-2017-3733-65c44a97","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"307764961371110327532486944532831782016","length":7223},"id":"CVE-2017-3733-82e85dca","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/t1_lib.c","function":"ssl_scan_clienthello_tlsext"}},{"deprecated":false,"digest":{"line_hashes":["237023091559719071527856149215891143070","189699015997182080260172145615480398912","205754833113741135528128949544990597477","23637003298103959430790520728083953975","213597452627353687285093948503028911800","275810834110559761518690632015236614750","207314614047805664642946047844901923545","305191548534231855931683526269868052734","16313483985969968253037914987938900902","179377070293683824358292918943174435313","232050462780820513567482654978609940575","38441374855202028092322068574612197487","92138724818817252465359871808234187635","169352110967265325462970483252633784500","286633373611893743639273053059705127436","6443239649188082457345121959534642301","174064454101845695950226691453089301155","4662727317159733501051761036001947942","94332607628410547235282447800067735086","302973741100356685495248678251481519784"],"threshold":0.9},"id":"CVE-2017-3733-845ca073","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/record/ssl3_record.c"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"include/openssl/ssl3.h"},"deprecated":false,"digest":{"line_hashes":["128397882952359198460105101864503598442","160741253838952962036697543913874864956","263861095183750585517548547657779822920","104028806768614615669326497823331697802","275448964672631935241613161816770308403"],"threshold":0.9},"id":"CVE-2017-3733-8d3dc5c2"},{"signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/ssl_locl.h"},"deprecated":false,"digest":{"line_hashes":["336287605999087885627445407507378051000","277172237984463495750704658317389696053","290773798954982555134968160155099884527","172712684677398947331358608258163928764","248020643342302205918131436038194688543","330509909880036231365085308199050967466","21714478470725859417744499070195627712","327371597548452006888585102874857308791"],"threshold":0.9},"id":"CVE-2017-3733-b2a80982","signature_type":"Line"},{"source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/record/ssl3_record.c","function":"ssl3_get_record"},"deprecated":false,"digest":{"function_hash":"170989265506574991648367742762289132608","length":7552},"id":"CVE-2017-3733-c1ddada3","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["273982395028049029384316770010417454720","216920195870000383157122377921091889302","131407537057305010023409765397459846353","12238822107440143773359101828113494684","205324185603807841097347780832483647617","72521799318336962915531310187700102818","317409089079101747653219409704270668724","62358020504739821728838816553930756276","102856837353583288873352422231041902655","287143937199201460399237938069067835137","230187990647120309916191553294369235021","64524494689283652454913155888817214777","293009343861220583380900713409323833555","151565873025519410166373721159430280977","12886728301838544092618672917871337164","164389040029164276714025556544678377336","115276761031037346409777596380856965821","326808888076382726820433371128071681565","92675416239956650708541565663338281682","58461224521287999952730954264911108528","67203642406244799105142181977534478018","117599346699133594434963058443644042523","91876357595659274532854729126485790270","20937716431750446600366564307056756563"],"threshold":0.9},"id":"CVE-2017-3733-d4a21c23","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/t1_lib.c"}},{"deprecated":false,"digest":{"line_hashes":["7542217128476095177380422397006445197","260270955145183264054661413207237965394","11246499031905434490821660329092439448","332130331106995121904797964412747523631","67366073130077609063323844893066781756","237049143005708034527252033370311160229","189616501985556496736028958556704578858","143210614436809875362313081788551382488","42080671283471120409974307738135291932","111656127582378586195554722857306440980","198581088139799038943765596436117447208","270867396637966758366786920891852731458"],"threshold":0.9},"id":"CVE-2017-3733-e2bcd8f1","signature_type":"Line","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/record/rec_layer_s3.c"}},{"digest":{"function_hash":"152609637236593721181395616200235391889","length":6778},"id":"CVE-2017-3733-f63bb928","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/t1_enc.c","function":"tls1_change_cipher_state"},"deprecated":false},{"digest":{"function_hash":"271553882449563555395616898008201693079","length":2255},"id":"CVE-2017-3733-fe19025e","signature_type":"Function","signature_version":"v1","source":"https://github.com/openssl/openssl/commit/4ad93618d26a3ea23d36ad5498ff4f59eff3a4d2","target":{"file":"ssl/t1_enc.c","function":"tls1_setup_key_block"},"deprecated":false}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}