« Volver al listado

CVE-2017-11144

Estado: ModificadaAlta (7.5)—

En PHP, en versiones anteriores a la 5.6.31, las versiones 7.x anteriores a la 7.0.21 y las versiones 7.1.x anteriores a la 7.1.7, el código de sellado PEM de la extensión openssl no comprobó el valor de retorno de la función de sellado de OpenSSL, lo que podría conducir al cierre inesperado del intérprete de PHP. Esto está relacionado con un conflicto de interpretación para un número negativo en ext/openssl/openssl.c y una omisión de documentación OpenSSL.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

PHP — PHP

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-11144",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-10T14:29:00.620",
  "references": [
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2017/07/10/6",
      "tags": [
        "Mailing List"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://php.net/ChangeLog-5.php",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://php.net/ChangeLog-7.php",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1296",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=74651",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20180112-0001/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4080",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4081",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.tenable.com/security/tns-2017-12",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=73cabfedf519298e1a11192699f44d53c529315e",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=89637c6b41b510c20d262c17483f582f115c66d6",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=91826a311dd37f4c4e5d605fa7af331e80ddd4c3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://openwall.com/lists/oss-security/2017/07/10/6",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://php.net/ChangeLog-5.php",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://php.net/ChangeLog-7.php",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2018:1296",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.php.net/bug.php?id=74651",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20180112-0001/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4080",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2018/dsa-4081",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tenable.com/security/tns-2017-12",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could lead to a crash of the PHP interpreter, related to an interpretation conflict for a negative number in ext/openssl/openssl.c, and an OpenSSL documentation omission."
    },
    {
      "lang": "es",
      "value": "En PHP, en versiones anteriores a la 5.6.31, las versiones 7.x anteriores a la 7.0.21 y las versiones 7.1.x anteriores a la 7.1.7, el código de sellado PEM de la extensión openssl no comprobó el valor de retorno de la función de sellado de OpenSSL, lo que podría conducir al cierre inesperado del intérprete de PHP. Esto está relacionado con un conflicto de interpretación para un número negativo en ext/openssl/openssl.c y una omisión de documentación OpenSSL."
    }
  ],
  "lastModified": "2026-06-17T01:01:17.970",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "399EA21A-9B46-4F4F-9A33-4DC557B11743",
              "versionEndIncluding": "5.6.30"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB6890AF-8A0A-46EE-AAD5-CF9AAE14A321"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B90B947-7B54-47F3-9637-2F4AC44079EE"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35848414-BD5D-4164-84DC-61ABBB1C4152"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B1F8402-8551-4F66-A9A7-81D472AB058E"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A773E8E-48CD-4D35-A0FD-629BD9334486"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC492340-79AF-4676-A161-079A97EC6F0C"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1C2D8FE-C380-4B43-B634-A3DBA4700A71"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EB58393-0C10-413C-8D95-6BAA8BC19A1B"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "751F51CA-9D88-4971-A6EC-8C0B72E8E22B"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37B74118-8FC2-44CB-9673-A83DF777B2E6"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D56A200-1477-40DA-9444-CFC946157C69"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.11:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD0D1CCC-A857-4C15-899E-08F9255CEE34"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6745CC43-2836-4CD8-848F-EEA08AE9D5AC"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BEB6696-14F9-4D9B-9974-B682FFBB828E"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04146390-021D-4147-9830-9EAA90D120A7"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B124547-DC1D-4A92-B8AB-8A1900063786"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F45B2127-CF3D-4D59-9042-AE6DF2908319"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29A450E3-931F-4487-A76D-80A38210297A"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C099A0C4-883D-42ED-8359-FFD3ADD692A3"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.19:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABD07432-5A23-491E-892E-42F0F58307D0"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.0.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19627ECC-9342-4917-8FCC-7757339E3242"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C68AA43-ED90-4B98-A5F8-4E210C2CC7CD"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2466D297-9442-40B0-A1A7-F9D166396CF8"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EADBF7EE-18DC-49F9-BF2F-A09BBAE76F45"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1726E9B6-A7FA-402B-A911-0CE81C623087"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3670FF7-2CA3-41A4-92FE-0123497E4E87"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C22CE03-DFE5-4CD3-B229-10B219A55434"
            },
            {
              "criteria": "cpe:2.3:a:php:php:7.1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C258AF27-84DF-4FC3-A651-1349BB567FB9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}