CVE-2018-0739: Canonical Ubuntu Linux

Medium severity, CVSS 6.5. EPSS: 18.6% chance of exploitation in the next 30 days.

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 17.10 only
• Debian Debian Linux: version 7.0 only; version 8.0 only; version 9.0 only
• OpenSSL OpenSSL: from 1.0.2b, up to and including 1.0.2n; from 1.1.0, up to and including 1.1.0g

Published 2018-03-27. Last modified 2026-06-17.