A microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information.(CVE-2018-5407)

If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable 'non-stitched' ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway).(CVE-2019-1559)

An update for ovmf is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OVMF (Open Virtual Machine Firmware) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.

Security Fix(es) :

* edk2: Privilege escalation via processing of malformed files in TianoCompress.c (CVE-2017-5731)

* edk2: Privilege escalation via processing of malformed files in BaseUefiDecompressLib.c (CVE-2017-5732)

* edk2: Privilege escalation via heap-based buffer overflow in MakeTable() function (CVE-2017-5733)

* edk2: Privilege escalation via stack-based buffer overflow in MakeTable() function (CVE-2017-5734)

* edk2: Privilege escalation via heap-based buffer overflow in Decode() function (CVE-2017-5735)

* edk2: Logic error in MdeModulePkg in EDK II firmware allows for privilege escalation by authenticated users (CVE-2018-3613)

* openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)

* edk2: Stack buffer overflow with corrupted BMP (CVE-2018-12181)

* edk2: buffer overflows in PartitionDxe and UdfDxe with long file names and invalid UDF media (CVE-2019-0160)

* edk2: stack overflow in XHCI causing denial of service (CVE-2019-0161)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

This update for openssl fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).

CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534).

CVE-2018-0737: Corrected the current error detection of the current fix (bsc#1106197).

CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018).

Add missing timing side channel patch for DSA signature generation (bsc#1113742).

Fixed the 'One and Done' side-channel attack on RSA (bsc#1104789).

Non-security issues fixed: Added openssl(cli) so that the packages that required the openssl binary can require this instead of the new openssl meta package (bsc#1101470).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).

CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534).

Add missing timing side channel patch for DSA signature generation (bsc#1113742).

Non-security issues fixed: Fixed infinite loop in DSA generation with incorrect parameters (bsc#1112209).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_0_0 fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).

CVE-2018-5407: Added elliptic curve scalar multiplication timing attack defenses that fixes 'PortSmash' (bsc#1113534).

Non-security issues fixed: Added missing timing side channel patch for DSA signature generation (bsc#1113742).

Set TLS version to 0 in msg_callback for record messages to avoid confusing applications (bsc#1100078).

Fixed infinite loop in DSA generation with incorrect parameters (bsc#1112209)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3840-1 advisory.

    Samuel Weiser discovered that OpenSSL incorrectly handled DSA signing. An attacker could possibly use this     issue to perform a timing side-channel attack and recover private DSA keys. (CVE-2018-0734)

    Samuel Weiser discovered that OpenSSL incorrectly handled ECDSA signing. An attacker could possibly use     this issue to perform a timing side-channel attack and recover private ECDSA keys. This issue only     affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-0735)

    Billy Bob Brumley, Cesar Pereida Garcia, Sohaib ul Hassan, Nicola Tuveri, and Alejandro Cabrera Aldaya     discovered that Simultaneous Multithreading (SMT) architectures are vulnerable to side-channel leakage.
    This issue is known as PortSmash. An attacker could possibly use this issue to perform a timing side-     channel attack and recover private keys. (CVE-2018-5407)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several local side channel attacks and a denial of service via large Diffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets Layer toolkit.

According to its self-reported version, the IBM BigFix Platform application running on the remote host is 9.5.x prior to 9.5.12. It is, therefore, affected by multiple vulnerabilities :

  - An arbitrary file upload vulnerability exists in IBM BigFix     Platform. An authenticated, remote attacker can exploit this     to upload arbitrary files on the remote host as the root user.
    (CVE-2019-4013)

  - An information disclosure vulnerability exists in IBM BigFix     Platform due to the PortSmash side-channel attack against     processors leveraging SMT/Hyper-Threading. An authenticated,     local attacker can exploit this to disclose potentially     sensitive information. (CVE-2018-5407)

  - A cross-site scripting (XSS) vulnerability exists due to     improper validation of user-supplied input before returning     it to users. An unauthenticated, remote attacker can exploit     this, by convincing a user to click a specially crafted URL,     to execute arbitrary script code in a user's browser session.
    (CVE-2012-5883, CVE-2012-6708, CVE-2015-9251)

IBM BigFix Platform was formerly known as Tivoli Endpoint Manager, IBM Endpoint Manager, and IBM BigFix Endpoint Manager.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3932 advisory.

    This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services     offering.

    This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and     includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant     bug fixes and enhancements included in this release.

    Security Fix(es):

    * openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to     recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm     (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl:
    Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) *     mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded     request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2:
    read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads     to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive     resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service     (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
124124	Amazon Linux 2 : openssl (ALAS-2019-1188)	Nessus	Amazon Linux Local Security Checks	2019/4/18	2024/6/3	medium
128356	CentOS 7 : ovmf (CESA-2019:2125)	Nessus	CentOS Local Security Checks	2019/8/30	2019/12/31	critical
119116	SUSE SLES12 Security Update : openssl (SUSE-SU-2018:3864-1)	Nessus	SuSE Local Security Checks	2018/11/23	2025/3/24	medium
119117	SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2018:3866-1)	Nessus	SuSE Local Security Checks	2018/11/23	2024/7/19	medium
120180	SUSE SLED15 / SLES15 Security Update : openssl-1_0_0 (SUSE-SU-2018:4001-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/9	medium
119497	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : OpenSSL vulnerabilities (USN-3840-1)	Nessus	Ubuntu Local Security Checks	2018/12/7	2025/9/3	medium
119313	Debian DSA-4348-1 : openssl - security update	Nessus	Debian Local Security Checks	2018/12/1	2025/3/24	medium
124565	IBM BigFix Platform 9.5.x < 9.5.12 Multiple Vulnerabilities	Nessus	Web Servers	2019/5/3	2019/10/30	critical
131215	RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 (Important) (RHSA-2019:3932)	Nessus	Red Hat Local Security Checks	2019/11/22	2024/11/7	high

检测

插件搜索

medium

critical

medium

medium

medium

medium

medium

critical

high