According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - openssl: ROHNP - Key Extraction Side Channel in     Multiple Crypto Libraries (CVE-2018-0495)

  - openssl: Malicious server can send large prime to     client during DH(E) TLS handshake causing the client to     hang (CVE-2018-0732)

  - openssl: Malformed X.509 IPAdressFamily could cause OOB     read (CVE-2017-3735)

  - openssl: RSA key generation cache timing vulnerability     in crypto/rsa/rsa_gen.c allows attackers to recover     private keys (CVE-2018-0737)

  - openssl: Handling of crafted recursive ASN.1 structures     can cause a stack overflow and resulting denial of     service (CVE-2018-0739)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_1 fixes the following issues :

  - CVE-2018-0732: During key agreement in a TLS handshake     using a DH(E) based ciphersuite a malicious server could     have sent a very large prime value to the client. This     caused the client to spend an unreasonably long period     of time generating a key for this prime resulting in a     hang until the client has finished. This could be     exploited in a Denial Of Service attack (bsc#1097158).

  - Blinding enhancements for ECDSA and DSA (bsc#1097624,     bsc#1098592)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_0_0 to 1.0.2p fixes the following issues :

These security issues were fixed :

Prevent One&Done side-channel attack on RSA that allowed physically near attackers to use EM emanations to recover information (bsc#1104789)

CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039)

CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158)

Make problematic ECDSA sign addition length-invariant

Add blinding to ECDSA and DSA signatures to protect against side channel attacks

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for VirtualBox 5.2.20 fixes security issues and bugs.

A number of vulnerabilities were fixed a affecting multiple components of VirtualBox bsc#1112097: CVE-2018-0732, CVE-2018-2909, CVE-2018-3287, CVE-2018-3288, CVE-2018-3289, CVE-2018-3290, CVE-2018-3291, CVE-2018-3292, CVE-2018-3293, CVE-2018-3294, CVE-2018-3295, CVE-2018-3296, CVE-2018-3297, and CVE-2018-3298. 

This update also contains various bug fixes in the 5.2.20 release :

  - VMM: fixed task switches triggered by INTn instruction

  - Storage: fixed connecting to certain iSCSI targets

  - Storage: fixed handling of flush requests when     configured to be ignored when the host I/O cache is used

  - Drag and drop fixes

  - Video recording: fixed starting video recording on VM     power up

  - Various fixes to Linux Additions

Patch for CVE-2018-0737, CVE-2018-0732, CVE-2018-0734, CVE-2019-1552, CVE-2019-1559.

https://www.openssl.org/news/vulnerabilities.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - An unspecified vulnerability in the subcomponent Networking     (jQuery) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. An easy to exploit     vulnerability could allow an unauthenticated attacker with     network access via HTTP to compromise Enterprise Manager Ops     Center. A successful attacks requires human interaction and     can result in unauthorized update, insert or delete access     to some of Enterprise Manager Ops Center accessible data.
    (CVE-2015-9251)

  - An unspecified vulnerability in the subcomponent Networking     (OpenSSL) of the Enterprise Manager Ops Center. Supported     versions that are affected are 12.2.2 and 12.3.3. An easy     to exploit vulnerability could allow an unauthenticated     attacker with network access via HTTPS to compromise     Enterprise Manager Ops Center. A successful attack of this     vulnerability could result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of     Enterprise Manager Ops Center. (CVE-2018-0732)

  - An unspecified vulnerability in the subcomponent Networking     (cURL) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. Difficult to exploit     vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Enterprise Manager Ops Center.
    A successful attack requires human interaction from a person     other than the attacker and can result in takeover of     Enterprise Manager Ops Center. (CVE-2018-1000300)

This update for openssl fixes the following issues :

  - CVE-2018-0732: During key agreement in a TLS handshake     using a DH(E) based ciphersuite a malicious server could     have sent a very large prime value to the client. This     caused the client to spend an unreasonably long period     of time generating a key for this prime resulting in a     hang until the client has finished. This could be     exploited in a Denial Of Service attack (bsc#1097158).

  - Blinding enhancements for ECDSA and DSA (bsc#1097624,     bsc#1098592)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl fixes the following issues :

  - CVE-2018-0732: During key agreement in a TLS handshake     using a DH(E) based ciphersuite a malicious server could     have sent a very large prime value to the client. This     caused the client to spend an unreasonably long period     of time generating a key for this prime resulting in a     hang until the client has finished. This could be     exploited in a Denial Of Service attack (bsc#1097158).

  - Blinding enhancements for ECDSA and DSA (bsc#1097624,     bsc#1098592)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for openssl-1_1 fixes the following issues :

  - CVE-2018-0732: During key agreement in a TLS handshake     using a DH(E) based ciphersuite a malicious server could     have sent a very large prime value to the client. This     caused the client to spend an unreasonably long period     of time generating a key for this prime resulting in a     hang until the client has finished. This could be     exploited in a Denial Of Service attack (bsc#1097158).

  - Blinding enhancements for ECDSA and DSA (bsc#1097624,     bsc#1098592)

This update was imported from the SUSE:SLE-15:Update update project.

Update to 1.1.0i version from upstream fixing minor security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
119909	EulerOS 2.0 SP2 : openssl (EulerOS-SA-2018-1420)	Nessus	Huawei Local Security Checks	2018/12/28	2025/3/21	medium
120057	SUSE SLES15 Security Update : openssl-1_1 (SUSE-SU-2018:2041-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	high
120115	SUSE SLES15 Security Update : openssl-1_0_0 (SUSE-SU-2018:2965-1)	Nessus	SuSE Local Security Checks	2019/1/2	2025/3/21	medium
123360	openSUSE Security Update : VirtualBox (openSUSE-2019-863)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/10	critical
129319	Fedora 30 : 1:compat-openssl10 (2019-00c25b9379)	Nessus	Fedora Local Security Checks	2019/9/25	2025/2/24	high
131184	Oracle Enterprise Manager Ops Center (Jan 2019 CPU)	Nessus	Misc.	2019/11/21	2024/11/4	critical
110938	SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2018:1887-1)	Nessus	SuSE Local Security Checks	2018/7/6	2024/9/6	high
110960	openSUSE Security Update : openssl (openSUSE-2018-704)	Nessus	SuSE Local Security Checks	2018/7/9	2024/9/5	high
111429	openSUSE Security Update : openssl-1_1 (openSUSE-2018-777)	Nessus	SuSE Local Security Checks	2018/7/30	2024/9/2	high
117891	Fedora 27 : 1:openssl (2018-02a38af202)	Nessus	Fedora Local Security Checks	2018/10/3	2025/3/25	medium

检测

插件搜索

medium

high

medium

critical

high

critical

high

high

high

medium