According to its self-reported version, the Tenable Nessus application running on the remote host is 8.x prior to 8.1.1. It is, therefore, affected by multiple vulnerabilities:

  - Tenable Nessus contains a flaw in the bundled third-party     component OpenSSL library's DSA signature algorithm that     renders it vulnerable to a timing side channel attack.
    An attacker could leverage this vulnerability to recover     the private key. (CVE-2018-0734)

  - Tenable Nessus contains a flaw in the bundled third-party     component OpenSSL library's Simultaneous Multithreading     (SMT) architectures which render it vulnerable to     side-channel leakage. This issue is known as 'PortSmash'.     An attacker could possibly use this issue to perform a     timing side-channel attack and recover private keys.     (CVE-2018-5407)

This update for openssl-1_0_0 fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).

CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534).

Add missing timing side channel patch for DSA signature generation (bsc#1113742).

Non-security issues fixed: Fixed infinite loop in DSA generation with incorrect parameters (bsc#1112209).

Set TLS version to 0 in msg_callback for record messages to avoid confusing applications (bsc#1100078).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).

CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534).

CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018).

Fixed the 'One and Done' side-channel attack on RSA (bsc#1104789).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_1 fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).

CVE-2018-0735: Fixed timing vulnerability in ECDSA signature generation (bsc#1113651).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation (bsc#1113652)

CVE-2018-5407: Fixed a hyperthread port content side channel attack (aka 'PortSmash') (bsc#1113534)

CVE-2018-12120: Fixed that the debugger listens on any interface by default (bsc#1117625)

CVE-2018-12121: Fixed a denial of Service with large HTTP headers (bsc#1117626)

CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of Service (bsc#1117627)

CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630)

CVE-2018-12123: Fixed hostname spoofing in URL parser for JavaScript protocol (bsc#1117629)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_0_0 fixes the following issues :

Security issues fixed :

  - CVE-2018-0734: Fixed timing vulnerability in DSA     signature generation (bsc#1113652).

  - CVE-2018-5407: Added elliptic curve scalar     multiplication timing attack defenses that fixes     'PortSmash' (bsc#1113534).

Non-security issues fixed :

  - Added missing timing side channel patch for DSA     signature generation (bsc#1113742).

  - Set TLS version to 0 in msg_callback for record messages     to avoid confusing applications (bsc#1100078).

  - Fixed infinite loop in DSA generation with incorrect     parameters (bsc#1112209)

This update was imported from the SUSE:SLE-15:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
120197	Tenable Nessus < 8.1.1 Multiple Vulnerabilities (TNS-2018-16)	Nessus	Misc.	2019/1/2	2023/2/8	medium
119457	SUSE SLED12 / SLES12 Security Update : openssl-1_0_0 (SUSE-SU-2018:3989-1)	Nessus	SuSE Local Security Checks	2018/12/6	2024/7/17	medium
119937	SUSE SLES11 Security Update : openssl (SUSE-SU-2018:4274-1)	Nessus	SuSE Local Security Checks	2018/12/28	2021/1/19	medium
120166	SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2018:3863-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	medium
121292	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2019:0117-1)	Nessus	SuSE Local Security Checks	2019/1/22	2024/6/26	high
119547	openSUSE Security Update : openssl-1_0_0 (openSUSE-2018-1518)	Nessus	SuSE Local Security Checks	2018/12/10	2024/7/16	medium

检测

插件搜索

medium

medium

medium

medium

high

medium