This update for openssl-1_1 fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).

CVE-2018-0735: Fixed timing vulnerability in ECDSA signature generation (bsc#1113651).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version, the Tenable Nessus application running on the remote host is 8.x prior to 8.1.1. It is, therefore, affected by multiple vulnerabilities:

  - Tenable Nessus contains a flaw in the bundled third-party     component OpenSSL library's DSA signature algorithm that     renders it vulnerable to a timing side channel attack.
    An attacker could leverage this vulnerability to recover     the private key. (CVE-2018-0734)

  - Tenable Nessus contains a flaw in the bundled third-party     component OpenSSL library's Simultaneous Multithreading     (SMT) architectures which render it vulnerable to     side-channel leakage. This issue is known as 'PortSmash'.     An attacker could possibly use this issue to perform a     timing side-channel attack and recover private keys.     (CVE-2018-5407)

This update for nodejs4 fixes the following issues :

Security issues fixed :

CVE-2018-0734: Fixed a timing vulnerability in the DSA signature generation (bsc#1113652)

CVE-2018-5407: Fixed a hyperthread port content side channel attack (aka 'PortSmash') (bsc#1113534)

CVE-2018-12120: Fixed that the debugger listens on any interface by default (bsc#1117625)

CVE-2018-12121: Fixed a denial of Service with large HTTP headers (bsc#1117626)

CVE-2018-12122: Fixed the 'Slowloris' HTTP Denial of Service (bsc#1117627)

CVE-2018-12116: Fixed HTTP request splitting (bsc#1117630)

CVE-2018-12123: Fixed hostname spoofing in URL parser for JavaScript protocol (bsc#1117629)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. (CVE-2018-0734)

The version of OpenSSL installed on the remote host is prior to 1.0.2q. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2q advisory.

  - Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to     timing attacks via a side-channel timing attack on 'port contention'. (CVE-2018-5407)

  - The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An     attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a     (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected     1.0.2-1.0.2p). (CVE-2018-0734)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3700 advisory.

  - openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)

  - openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)

  - openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
120166	SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2018:3863-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	medium
120197	Tenable Nessus < 8.1.1 Multiple Vulnerabilities (TNS-2018-16)	Nessus	Misc.	2019/1/2	2023/2/8	medium
121292	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2019:0117-1)	Nessus	SuSE Local Security Checks	2019/1/22	2024/6/26	high
121366	Amazon Linux 2 : openssl (ALAS-2019-1153)	Nessus	Amazon Linux Local Security Checks	2019/1/25	2024/6/26	medium
121383	OpenSSL 1.0.2 < 1.0.2q Multiple Vulnerabilities	Nessus	Web Servers	2019/1/25	2024/10/23	medium
145661	CentOS 8 : openssl (CESA-2019:3700)	Nessus	CentOS Local Security Checks	2021/1/29	2025/2/20	high

检测

插件搜索

medium

medium

high

medium

medium

high