An update of the libgcrypt package has been released.

libgcrypt 用のこの更新は、次の問題を修正します：

キャッシュサイドチャネル攻撃の軽減：

  - CVE-2019-12904：AESのC実装は、フラッシュとリロードのサイドチャネル攻撃に対して脆弱です。これは、物理アドレスが他のプロセスで使用できるためです。（C言語の実装は、アセンブリ言語の実装が利用できないプラットフォームで使用されます。）（bsc#1138939）

その他のバグ修正：

  - コンストラクターから完全なFIPS自己テストを実行しません（bsc#1097073）

  - コンストラクターから呼び出された場合に、バイナリ整合性を除くすべてのセルフテストをスキップします（bsc#1097073）

  - fipsモードでRSA keygenの最小サイズを実施します（bsc#1125740）

  - 一部のテストを2回実行することを回避します。

  - 初期化の競合状態を修正しました。

  - cavs_driver.plのenv-script-interpreterを修正しました

  - fipsモードでの起動の失敗を引き起こす一部の状況での冗長fipsテストを修正しました。（bsc#1097073）

これは、エントロピーが不十分なFIPSモードでのシステムの起動中に役立ちます。

この更新はSUSEからインポートされました：SLE-15：更新プロジェクトを更新します。

libgcrypt 用のこの更新は、次の問題を修正します：

修正されたセキュリティ問題：

CVE-2019-12904：AES実装のflush-and-reloadサイドチャネル攻撃を修正しました（bsc#1138939）。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

libgcrypt 用のこの更新は、次の問題を修正します：

キャッシュサイドチャネル攻撃の軽減：

CVE-2019-12904：AESのC実装は、フラッシュとリロードのサイドチャネル攻撃に対して脆弱です。これは、物理アドレスが他のプロセスで使用できるためです。（C言語の実装は、アセンブリ言語の実装が利用できないプラットフォームで使用されます。）（bsc#1138939）

その他のバグ修正：コンストラクターから完全なFIPS自己テストを実行しません（bsc#1097073）

コンストラクターから呼び出された場合に、バイナリ整合性を除くすべてのセルフテストをスキップします（bsc#1097073）

fipsモードでRSA keygenの最小サイズを実施します（bsc#1125740）

一部のテストを2回実行することを回避します。

初期化の競合状態を修正しました。

cavs_driver.plのenv-script-interpreterを修正しました

fipsモードでの起動の失敗を引き起こす一部の状況での冗長fipsテストを修正しました。（bsc#1097073）

これは、エントロピーが不十分なFIPSモードでのシステムの起動中に役立ちます。

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

This update for libgcrypt fixes the following issues :

Security issue fixed :

CVE-2019-12904: Fixed a flush-and-reload side-channel attack in the AES implementation (bsc#1138939).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issues :

Security issues fixed :

  - CVE-2019-12904: The C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.) (bsc#1138939)

Other bugfixes :

  - Don't run full FIPS self-tests from constructor     (bsc#1097073)

  - Skip all the self-tests except for binary integrity when     called from the constructor (bsc#1097073)

  - Enforce the minimal RSA keygen size in fips mode     (bsc#1125740)

  - avoid executing some tests twice.

  - Fixed a race condition in initialization.

  - Fixed env-script-interpreter in cavs_driver.pl

  - Fixed redundant fips tests in some situations causing     failure to boot in fips mode. (bsc#1097073)

This helps during booting of the system in FIPS mode with insufficient entropy.

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - Libgcrypt: physical addresses being available to other processes leads to a flush-and-reload side-channel     attack (CVE-2019-12904)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libgcrypt: Use of left-to-right sliding window method allows full RSA key recovery (CVE-2017-7526)

  - Libgcrypt: physical addresses being available to other processes leads to a flush-and-reload side-channel     attack (CVE-2019-12904)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the libgcrypt package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4.
    Versions fixed: 1.8.5-2 and     1.6.3-2+deb8u7.(CVE-2019-13627)

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libgcrypt: Use of left-to-right sliding window method allows full RSA key recovery (CVE-2017-7526)

  - Libgcrypt: physical addresses being available to other processes leads to a flush-and-reload side-channel     attack (CVE-2019-12904)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Libgcrypt 1.8.4, the C implementation of AES is     vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other     processes. (The C implementation is used on platforms     where an assembly-language implementation is     unavailable.)(CVE-2019-12904)

  - It was discovered that there was a ECDSA timing attack     in the libgcrypt20 cryptographic library. Version     affected: 1.8.4-5, 1.7.6-2+deb9u3, and     1.6.3-2+deb8u4.(CVE-2019-13627)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issues :

Security issues fixed :

CVE-2019-12904: The C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) (bsc#1138939)

Other bugfixes: Don't run full FIPS self-tests from constructor (bsc#1097073)

Skip all the self-tests except for binary integrity when called from the constructor (bsc#1097073)

Enforce the minimal RSA keygen size in fips mode (bsc#1125740)

avoid executing some tests twice.

Fixed a race condition in initialization.

Fixed env-script-interpreter in cavs_driver.pl

Fixed redundant fips tests in some situations causing failure to boot in fips mode. (bsc#1097073)

This helps during booting of the system in FIPS mode with insufficient entropy.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libgcrypt: PRNG output is predictable (CVE-2016-6313)

  - libgcrypt: Use of left-to-right sliding window method allows full RSA key recovery (CVE-2017-7526)

  - In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack     because physical addresses are available to other processes. (The C implementation is used on platforms     where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue     report cannot be validated because there is no description of an attack (CVE-2019-12904)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	名稱	產品	系列	已發布	已更新	嚴重性
203084	Photon OS 3.0: Libgcrypt PHSA-2019-3.0-0036	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	medium
126976	openSUSEセキュリティ更新プログラム：libgcrypt（openSUSE-2019-1792）	Nessus	SuSE Local Security Checks	2019/7/24	2024/5/8	medium
127089	SUSE SLED15 / SLES15セキュリティ更新プログラム：libgcrypt（SUSE-SU-2019:1971-1）	Nessus	SuSE Local Security Checks	2019/7/26	2024/5/8	medium
126770	SUSE SLED15 / SLES15セキュリティ更新プログラム：libgcrypt（SUSE-SU-2019:1859-1）	Nessus	SuSE Local Security Checks	2019/7/17	2024/5/9	medium
127089	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:1971-1)	Nessus	SuSE Local Security Checks	2019/7/26	2024/5/8	medium
203109	Photon OS 2.0: Libgcrypt PHSA-2020-2.0-0227	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	medium
126976	openSUSE Security Update : libgcrypt (openSUSE-2019-1792)	Nessus	SuSE Local Security Checks	2019/7/24	2024/5/8	medium
199133	RHEL 8 : libgcrypt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium
199174	RHEL 6 : libgcrypt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium
135490	Photon OS 1.0: Libgcrypt PHSA-2020-1.0-0288	Nessus	PhotonOS Local Security Checks	2020/4/15	2020/4/21	medium
132839	EulerOS Virtualization for ARM 64 3.0.5.0 : libgcrypt (EulerOS-SA-2020-1085)	Nessus	Huawei Local Security Checks	2020/1/13	2022/5/18	medium
199144	RHEL 7 : libgcrypt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium
130816	EulerOS 2.0 SP8 : libgcrypt (EulerOS-SA-2019-2107)	Nessus	Huawei Local Security Checks	2019/11/12	2022/5/18	medium
126770	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:1859-1)	Nessus	SuSE Local Security Checks	2019/7/17	2024/5/9	medium
199239	RHEL 5 : libgcrypt (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium