CVE-2018-0734: Canonical Ubuntu Linux

Medium severity, CVSS 5.9. EPSS: 12.2% chance of exploitation in the next 30 days.

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

Affected products

  • Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only
  • Debian Debian Linux: version 9.0 only
  • Netapp Cloud Backup: affected versions not specified
  • Netapp CN1610 Firmware: affected versions not specified
  • Netapp Oncommand Unified Manager: any version
  • Netapp Santricity Smi-S Provider: affected versions not specified
  • Netapp Snapcenter: affected versions not specified
  • Netapp Steelstore: affected versions not specified
  • Netapp Storage Automation Store: affected versions not specified
  • Node.js Node.js: from 6.0.0, up to and including 6.8.1; from 6.9.0, before 6.15.0 (fixed in 6.15.0); from 8.0.0, up to and including 8.8.1; from 8.9.0, before 8.14.0 (fixed in 8.14.0); from 10.0.0, up to and including 10.12.0; from 11.0.0, before 11.3.0 (fixed in 11.3.0); …
  • OpenSSL OpenSSL: from 1.0.2, up to and including 1.0.2p; from 1.1.0, up to and including 1.1.0i; version 1.1.1 only
  • Oracle API Gateway: version 11.1.2.4.0 only
  • Oracle E-Business Suite Technology Stack: version 0.9.8 only; version 1.0.0 only; version 1.0.1 only
  • Oracle Enterprise Manager Base Platform: version 12.1.0.5.0 only; version 13.2.0.0.0 only; version 13.3.0.0.0 only
  • Oracle Enterprise Manager Ops Center: version 12.3.3 only
  • Oracle MySQL Enterprise Backup: from 3.0, up to and including 3.12.3; from 4.0, up to and including 4.1.2
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.55 only; version 8.56 only; version 8.57 only
  • Oracle Primavera p6 Professional Project Management: from 17.7, up to and including 17.12; version 8.4 only; version 15.1 only; version 15.2 only; version 16.1 only; version 16.2 only; …
  • Oracle Tuxedo: version 12.1.1.0.0 only

Published 2018-10-30. Last modified 2026-10-08.