The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2237 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

    The following packages have been upgraded to a later upstream version: nss (3.44.0), nss-softokn (3.44.0),     nss-util (3.44.0), nspr (4.21.0). (BZ#1645231, BZ#1692269, BZ#1692271, BZ#1692274)

    Security Fix(es):

    * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

    * nss: Cache side-channel variant of the Bleichenbacher attack (CVE-2018-12404)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the nss-softokn packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A cached side channel attack during handshakes using     RSA encryption could allow for the decryption of     encrypted content. This is a variant of the Adaptive     Chosen Ciphertext attack (AKA Bleichenbacher attack)     and affects all NSS versions prior to NSS     3.41.(CVE-2018-12404)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41. (CVE-2018-12404)

Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the
_gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host. (CVE-2018-0495)

According to the versions of the nss-softokn packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A cached side channel attack during handshakes using     RSA encryption could allow for the decryption of     encrypted content. This is a variant of the Adaptive     Chosen Ciphertext attack (AKA Bleichenbacher attack)     and affects all NSS versions prior to NSS     3.41.(CVE-2018-12404)

  - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a     memory-cache side-channel attack on ECDSA signatures     that can be mitigated through the use of blinding     during the signing process in the _gcry_ecc_ecdsa_sign     function in cipher/ecc-ecdsa.c, aka the Return Of the     Hidden Number Problem or ROHNP. To discover an ECDSA     key, the attacker needs access to either the local     machine or a different virtual machine on the same     physical host.(CVE-2018-0495)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-4268:01 advisory.

    * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)
      * nss: Cache side-channel variant of the Bleichenbacher attack (CVE-2018-12404)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
127699	RHEL 7 : nss, nss-softokn, nss-util, and nspr (RHSA-2019:2237)	Nessus	Red Hat Local Security Checks	2019/8/12	2025/2/24	medium
129173	EulerOS 2.0 SP5 : nss-softokn (EulerOS-SA-2019-1979)	Nessus	Huawei Local Security Checks	2019/9/24	2025/2/24	medium
129563	Amazon Linux 2 : nss (ALAS-2019-1305)	Nessus	Amazon Linux Local Security Checks	2019/10/4	2025/2/24	medium
134541	EulerOS Virtualization for ARM 64 3.0.2.0 : nss-softokn (EulerOS-SA-2020-1252)	Nessus	Huawei Local Security Checks	2020/3/13	2025/2/21	medium
289852	MiracleLinux 7 : nspr-4.21.0-1.el7, nss-util-3.44.0-3.el7, nss-softokn-3.44.0-5.el7, nss-3.44.0-4.el7 (AXSA:2019-4268:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	medium

检测

插件搜索

medium

medium

medium

medium

medium