CVE-2017-3735

What it actually does

One-byte overread when parsing the IPAddressFamily extension in an X.509 certificate causes incorrect text rendering of the certificate contents.

Why it matters to the business

Operators may make trust or access decisions based on a misrendered certificate, and the long-standing nature of the flaw across widely deployed TLS libraries increases operational exposure in certificate-heavy environments.

How an attack unfolds

An attacker supplies a crafted X.509 certificate containing a malformed IPAddressFamily extension to any OpenSSL-based TLS endpoint or verification routine; the one-byte overread occurs during parsing and produces a corrupted text representation of the certificate without further memory corruption or code execution.

How to fix it

Upgrade OpenSSL to 1.0.2m, 1.1.0g or later releases; rebuild and redeploy all dependent applications and restart services that link against the library.

How to confirm the fix worked

Confirm the installed OpenSSL version is at or above the fixed releases; test certificate parsing with known malformed IPAddressFamily test vectors and verify correct text output.

Typical attack path

1. Attacker generates or obtains a certificate with a specially constructed IPAddressFamily extension
2. Victim application or server processes the certificate using a vulnerable OpenSSL version
3. Overread occurs during extension parsing, resulting in incorrect displayed certificate data
4. Operator or automated system acts on the erroneous certificate text

How to detect it

Review TLS handshake or certificate validation logs for entries involving IPAddressFamily extensions; compare rendered certificate text against the binary contents of received certificates to spot discrepancies.

What your security team should do

• Immediately inventory all systems using OpenSSL and schedule upgrades to 1.0.2m or 1.1.0g
• Prioritize patching on any externally facing TLS terminators or certificate validation services
• Update build pipelines and package repositories to prevent reintroduction of vulnerable versions