# MA-650.022017: MyCERT Advisory - OpenSSL Releases Security Update

**Date:** 21 Feb 2017  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-650.022017  
**Advisory ID:** MA-650.022017

---

**1.0 Introduction**
OpenSSL version 1.1.0e has been released to address a vulnerability for users of version 1.1.0.
**2.0 Impact**
• Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition.
• Description: Encrypt-Then-Mac renegotiation crash (CVE-2017-3733). During a renegotiation handshake if the Encrypt-Then-Mac extension is negotiated where it was not in the original handshake (or vice-versa) then this can cause OpenSSL to crash (dependent on ciphersuite). Both clients and servers are affected.
• Severity: High
**3.0 Affected Products**
• OpenSSL 1.1.0
**4.0 Recommendation**
Users of affected versions of OpenSSL are advised to apply the updates accordingly as per below:
• OpenSSL 1.1.0 users should upgrade to 1.1.0e
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied. For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#47243e2522357e7e7e07243e25223534222432352e333e692a3e) or [[email protected]](mycert@mycert.org.my) â€¨
Phone: 1-300-88-2999 (monitored during business hours)â€¨
Fax: +603 89453442 â€¨Mobile: +60 19 2665850 (24x7 call incident reporting)
â€¨SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
â€¨Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYTâ€¨
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
• <https://www.us-cert.gov/ncas/current-activity/2017/02/16/OpenSSL-Releases-Security-Update>
• <https://www.openssl.org/news/secadv/20170216.txt>