Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-0734

26
FAUCET Score

CVE-2018-0734 describes a timing side-channel vulnerability in the OpenSSL DSA signature algorithm, affecting versions 1.1.1, 1.1.0-1.1.0i, and 1.0.2-1.0.2p, as well as products like Canonical, Debian, and Node.js. This medium-severity flaw (CVSS 5.9) allows an unauthenticated attacker to potentially recover the private key by observing variations in the signing process, though the attack complexity is high. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.0.2, <= 1.0.2pCPE matchmatch criteria
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
>= 1.1.0, <= 1.1.0iCPE matchmatch criteria
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
1.1.1CPE matchmatch criteria
cpe:2.3:a:openssl:openssl:1.1.1:*:*:*:*:*:*:*
14.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
16.04CPE matchmatch criteria
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.9MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
12.15%
Probability of exploitation in next 30 days
EPSS Percentile
95.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.1215 is in the 96th percentile among its peer group of 19,955 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (40)

microsoftpatch availablevia msrc
Product: 16918-16820Fixed in: 14.17.2-1
microsoftpatch availablevia msrc
Product: cm1 nodejs 14.17.2-1 on CBL Mariner 1.0Fixed in: 14.17.2-1
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-jansson-0:2.11-20.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-jansson-0:2.11-20.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Tower 3.4 for RHEL 7Fixed in: ansible-tower-34/ansible-tower-memcached:1.4.15-28
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Tower 3.4 for RHEL 7Fixed in: ansible-tower-35/ansible-tower-memcached:1.4.15-28
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Ansible Tower 3.4 for RHEL 7Fixed in: ansible-tower-37/ansible-tower-memcached-rhel7:1.4.15-28
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: openssl-1:1.0.2k-19.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: openssl-1:1.1.1c-2.el8
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCSFixed in: openssl
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 6Fixed in: openssl
redhatvendor investigatingvia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: mingw-openssl
redhatno patchvia redhat_api
Product: Red Hat JBoss Web Server 3Fixed in: openssl
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: OVMF
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: openssl
redhatend of lifevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 2Fixed in: openssl
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: compat-openssl10
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: openssl098e
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: openssl098e

Vendor Advisories (2)

redhatCVE-2018-0734Low

openssl: timing side channel attack in the DSA signature algorithm

Oct 16, 2018
microsoft2018-Oct/CVE-2018-0734Moderate

Timing attack against DSA

Oct 9, 2018

References

lists.opensuse.org / opensuse-security-announce/2019-06/msg00030.html
Mailing ListThird Party Advisory
lists.opensuse.org / opensuse-security-announce/2019-07/msg00056.html
Mailing ListThird Party Advisory
access.redhat.com / errata/RHSA-2019:2304
Third Party Advisory
access.redhat.com / errata/RHSA-2019:3700
Third Party Advisory
access.redhat.com / errata/RHSA-2019:3932
Third Party Advisory
access.redhat.com / errata/RHSA-2019:3933
Third Party Advisory
access.redhat.com / errata/RHSA-2019:3935
Third Party Advisory
git.openssl.org / gitweb
git.openssl.org / gitweb
git.openssl.org / gitweb
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V
nodejs.org / en/blog/vulnerability/november-2018-security-releases
Third Party Advisory
security.netapp.com / advisory/ntap-20181105-0002
Third Party Advisory
security.netapp.com / advisory/ntap-20190118-0002
Third Party Advisory
security.netapp.com / advisory/ntap-20190423-0002
Third Party Advisory
usn.ubuntu.com / 3840-1
Third Party Advisory
debian.org / security/2018/dsa-4348
Third Party Advisory
debian.org / security/2018/dsa-4355
Third Party Advisory
openssl.org / news/secadv/20181030.txt
Vendor Advisory
oracle.com / security-alerts/cpuapr2020.html
Third Party Advisory
oracle.com / security-alerts/cpujan2020.html
Third Party Advisory
oracle.com / technetwork/security-advisory/cpuapr2019-5072813.html
PatchThird Party Advisory
oracle.com / technetwork/security-advisory/cpujan2019-5072801.html
PatchThird Party Advisory
oracle.com / technetwork/security-advisory/cpujul2019-5072835.html
PatchThird Party Advisory
tenable.com / security/tns-2018-16
Third Party Advisory
tenable.com / security/tns-2018-17
Third Party Advisory
securityfocus.com / bid/105758
Third Party AdvisoryVDB Entry