This update for openssl-1_0_0 to 1.0.2p fixes the following issues :

These security issues were fixed :

Prevent One&Done side-channel attack on RSA that allowed physically near attackers to use EM emanations to recover information (bsc#1104789)

CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039)

CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158)

Make problematic ECDSA sign addition length-invariant

Add blinding to ECDSA and DSA signatures to protect against side channel attacks

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Patch for CVE-2018-0737, CVE-2018-0732, CVE-2018-0734, CVE-2019-1552, CVE-2019-1559.

https://www.openssl.org/news/vulnerabilities.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - An unspecified vulnerability in the subcomponent Networking     (jQuery) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. An easy to exploit     vulnerability could allow an unauthenticated attacker with     network access via HTTP to compromise Enterprise Manager Ops     Center. A successful attacks requires human interaction and     can result in unauthorized update, insert or delete access     to some of Enterprise Manager Ops Center accessible data.
    (CVE-2015-9251)

  - An unspecified vulnerability in the subcomponent Networking     (OpenSSL) of the Enterprise Manager Ops Center. Supported     versions that are affected are 12.2.2 and 12.3.3. An easy     to exploit vulnerability could allow an unauthenticated     attacker with network access via HTTPS to compromise     Enterprise Manager Ops Center. A successful attack of this     vulnerability could result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of     Enterprise Manager Ops Center. (CVE-2018-0732)

  - An unspecified vulnerability in the subcomponent Networking     (cURL) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. Difficult to exploit     vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Enterprise Manager Ops Center.
    A successful attack requires human interaction from a person     other than the attacker and can result in takeover of     Enterprise Manager Ops Center. (CVE-2018-1000300)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3932 advisory.

    This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services     offering.

    This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and     includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant     bug fixes and enhancements included in this release.

    Security Fix(es):

    * openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to     recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm     (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl:
    Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) *     mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded     request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2:
    read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads     to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive     resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service     (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for openssl fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).

CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534).

CVE-2018-0737: Corrected the current error detection of the current fix (bsc#1106197).

CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018).

Add missing timing side channel patch for DSA signature generation (bsc#1113742).

Fixed the 'One and Done' side-channel attack on RSA (bsc#1104789).

Non-security issues fixed: Added openssl(cli) so that the packages that required the openssl binary can require this instead of the new openssl meta package (bsc#1101470).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3221 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Security Fix(es):

    * openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

    * openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client     to hang (CVE-2018-0732)

    * openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial     of service (CVE-2018-0739)

    * openssl: Malformed X.509 IPAdressFamily could cause OOB read (CVE-2017-3735)

    * openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to     recover private keys (CVE-2018-0737)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for openssl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es) :

* openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

* openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang (CVE-2018-0732)

* openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service (CVE-2018-0739)

* openssl: Malformed X.509 IPAdressFamily could cause OOB read (CVE-2017-3735)

* openssl: RSA key generation cache timing vulnerability in crypto/rsa/ rsa_gen.c allows attackers to recover private keys (CVE-2018-0737)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

ID	名稱	產品	系列	已發布	已更新	嚴重性
120115	SUSE SLES15 Security Update : openssl-1_0_0 (SUSE-SU-2018:2965-1)	Nessus	SuSE Local Security Checks	2019/1/2	2025/3/21	medium
129319	Fedora 30 : 1:compat-openssl10 (2019-00c25b9379)	Nessus	Fedora Local Security Checks	2019/9/25	2025/2/24	high
131184	Oracle Enterprise Manager Ops Center (Jan 2019 CPU)	Nessus	Misc.	2019/11/21	2024/11/4	critical
131215	RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 (Important) (RHSA-2019:3932)	Nessus	Red Hat Local Security Checks	2019/11/22	2024/11/7	high
119116	SUSE SLES12 Security Update : openssl (SUSE-SU-2018:3864-1)	Nessus	SuSE Local Security Checks	2018/11/23	2025/3/24	medium
118534	RHEL 7 : openssl (RHSA-2018:3221)	Nessus	Red Hat Local Security Checks	2018/10/31	2025/3/25	medium
118998	CentOS 7 : openssl (CESA-2018:3221)	Nessus	CentOS Local Security Checks	2018/11/16	2025/3/24	medium

偵測

搜尋 Plugin

medium

high

critical

high

medium

medium

medium