CVE-2018-0733 is an implementation bug in the OpenSSL CRYPTO_memcmp function on HP-UX PA-RISC targets, specifically affecting OpenSSL versions 1.1.0 through 1.1.0g. This flaw reduces the comparison to only the least significant bit of each byte, allowing attackers to forge authenticated messages with fewer attempts than intended. The vulnerability has a CVSS score of 5.9 (Medium), indicating a network-based attack with high integrity impact and high attack complexity, requiring no user interaction. While it can lead to message forgery, there is no direct impact on confidentiality or availability. There is no known active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, suggesting limited public awareness or active threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.1.0, <= 1.1.0gCPE matchmatch criteria | cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.