This update for openssl fixes the following security issue :

  - CVE-2018-0737: The RSA Key generation algorithm has been     shown to be vulnerable to a cache timing side channel     attack. An attacker with sufficient access to mount     cache timing attacks during the RSA key generation     process could have recovered the private key     (bsc#1089039).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New openssl packages are available for Slackware 14.2 and -current to fix security issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-4248 advisory.

    - Oracle bug 28730228: backport CVE-2018-0732

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the remote Juniper Junos device is affected by a multiple vulnerabilities:

- During key agreement in a TLS handshake using a DH(E) based   ciphersuite a malicious server can send a very large prime value to   the client. This will cause the client to spend an unreasonably   long period of time generating a key for this prime resulting in a   hang until the client has finished. This could be exploited in a   Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected   1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
  (CVE-2018-0732)   
- The OpenSSL RSA Key generation algorithm has been shown to be   vulnerable to a cache timing side channel attack. An attacker with   sufficient access to mount cache timing attacks during the RSA key   generation process could recover the private key. Fixed in OpenSSL   1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev   (Affected 1.0.2b-1.0.2o). (CVE-2018-0737)

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) installation running on the remote web server is 8.4 prior to 8.4.15.9, 15.x prior to 15.2.18.3, 16.x prior to 16.2.17.0, 17.x prior to 17.12.10.0, or 18.x prior to 18.8.5.0. It is, therefore, affected by multiple vulnerabilities:

  - A denial of service (DoS) vulnerability exists in     OpenSSL due to an issue processing very large prime     values during TLS handshakes using a DH(E) based     ciphersuite. An unauthenticated, remote attacker can     exploit this issue to cause the client to stop     responding. (CVE-2018-0732)

  - The OpenSSL RSA Key generation algorithm is vulnerable     to a chache timing side channel attack. An attacker can     exploit this to potentially recover the private key.
    (CVE-2018-0737)

  - The Web Access subcomponent of Oracle Primavera P6 EPPM     is affected by a vulnerability which could allow an     unauthenticated attacker with HTTP access to compromise     the system. Successful exploitation of this vulnerability     require user interaction, and could result in     unauthorized read/write access to Primavera P6 EPPM data.     (CVE-2019-2512)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for openssl fixes the following issues :

CVE-2018-0732: Reject excessively large primes in DH key generation (bsc#1097158)

CVE-2018-0734: Timing vulnerability in DSA signature generation (bsc#1113652)

CVE-2018-0737: Cache timing vulnerability in RSA Key Generation (bsc#1089039)

CVE-2018-5407: Elliptic curve scalar multiplication timing attack defenses (fixes 'PortSmash') (bsc#1113534)

CVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown (bsc#1127080)

Fix One&Done side-channel attack on RSA (bsc#1104789)

Reject invalid EC point coordinates (bsc#1131291)

The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS Implementations (bsc#1117951)

Add missing error string to CVE-2016-8610 fix (bsc#1110018#c9)

blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)

Non security fixes: correct the error detection in the fips patch (bsc#1106197)

Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3727:01 advisory.

    * openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)
      * openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client     to hang (CVE-2018-0732)
      * openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting     denial of service (CVE-2018-0739)
      * openssl: Malformed X.509 IPAdressFamily could cause OOB read (CVE-2017-3735)
      * openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to     recover private keys (CVE-2018-0737)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
112145	SUSE SLES12 Security Update : openssl (SUSE-SU-2018:2492-1)	Nessus	SuSE Local Security Checks	2018/8/28	2025/3/26	medium
111737	Slackware 14.2 / current : openssl (SSA:2018-226-01)	Nessus	Slackware Local Security Checks	2018/8/15	2025/3/26	medium
118105	Oracle Linux 6 : openssl (ELSA-2018-4248)	Nessus	Oracle Linux Local Security Checks	2018/10/15	2025/3/25	medium
121069	Junos OS: OpenSSL Security Advisories [16 Apr 2018] and [12 June 2018] (JSA10919)	Nessus	Junos Local Security Checks	2019/1/11	2025/3/21	medium
121252	Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (Jan 2019 CPU)	Nessus	CGI abuses	2019/1/18	2025/3/21	medium
126046	SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)	Nessus	SuSE Local Security Checks	2019/6/19	2022/12/5	medium
289355	MiracleLinux 7 : openssl-1.0.2k-16.0.1.el7.AXS7 (AXSA:2019-3727:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium