{"id": "SUSE_SU-2019-1553-1.NASL", "bulletinFamily": "scanner", "title": "SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)", "description": "This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes ", "published": "2019-06-19T00:00:00", "modified": "2020-04-02T00:00:00", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "href": "https://www.tenable.com/plugins/nessus/126046", "reporter": "This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://bugzilla.suse.com/show_bug.cgi?id=1127080", "https://bugzilla.suse.com/show_bug.cgi?id=1117951", "https://www.suse.com/security/cve/CVE-2019-1559/", "https://bugzilla.suse.com/show_bug.cgi?id=1089039", "https://bugzilla.suse.com/show_bug.cgi?id=1110018", "https://bugzilla.suse.com/show_bug.cgi?id=1097158", "https://bugzilla.suse.com/show_bug.cgi?id=1097624", "https://www.suse.com/security/cve/CVE-2018-0734/", "https://bugzilla.suse.com/show_bug.cgi?id=1113652", "https://www.suse.com/security/cve/CVE-2018-5407/", "https://www.suse.com/security/cve/CVE-2018-0737/", "https://bugzilla.suse.com/show_bug.cgi?id=1106197", "https://bugzilla.suse.com/show_bug.cgi?id=1113534", "https://bugzilla.suse.com/show_bug.cgi?id=1101470", "https://www.suse.com/security/cve/CVE-2018-0732/", "https://www.suse.com/security/cve/CVE-2016-8610/", "https://bugzilla.suse.com/show_bug.cgi?id=1098592", "http://www.nessus.org/u?ce5eebf3", "https://bugzilla.suse.com/show_bug.cgi?id=1104789", "https://bugzilla.suse.com/show_bug.cgi?id=1131291"], "cvelist": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "type": "nessus", "lastseen": "2020-04-01T02:57:11", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:novell:suse_linux:openssl-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo", "p-cpe:/a:novell:suse_linux:openssl", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0", "p-cpe:/a:novell:suse_linux:openssl-debugsource"], "cvelist": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cvss3": {"score": 5.9, "vector": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}, "description": "This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes ", "edition": 7, "enchantments": {"dependencies": {"modified": "2020-03-18T03:06:50", "references": [{"idList": ["SOL11307303", "F5:K43741620", "F5:K21665601", "F5:K49711130", "F5:K18549143", "F5:K43429502", "F5:K11307303"], "type": "f5"}, {"idList": ["SSA-2018-226-01"], "type": "slackware"}, {"idList": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "type": "cve"}, {"idList": ["SMNTC-104442", "SMNTC-105758", "SMNTC-107174"], "type": "symantec"}, {"idList": ["RHSA-2019:2304"], "type": "redhat"}, {"idList": ["PAN-SA-2019-0039"], "type": "paloalto"}, {"idList": ["OPENSSL_ADVISORY28.ASC", "OPENSSL_ADVISORY27.ASC", "OPENSSL_ADVISORY29.ASC"], "type": "aix"}, {"idList": ["H1:364964"], "type": "hackerone"}, {"idList": ["ELSA-2019-2304", "ELSA-2019-2471", "ELSA-2018-4248", "ELSA-2018-4254", "ELSA-2019-4754", "ELSA-2018-4249", "ELSA-2018-4253"], "type": "oraclelinux"}, {"idList": ["ALAS-2019-1188"], "type": "amazon"}, {"idList": ["GLSA-201903-10"], "type": "gentoo"}, {"idList": ["FEDORA_2019-DB06EFDEA1.NASL", "NESSUS_TNS_2018_17.NASL", "SUSE_SU-2018-3864-1.NASL", "FEDORA_2019-00C25B9379.NASL", "OPENSUSE-2018-1529.NASL", "DEBIAN_DSA-4348.NASL", "DEBIAN_DSA-4355.NASL", "OPENSSL_1_1_0I.NASL", "SUSE_SU-2018-4068-1.NASL", "SUSE_SU-2018-4274-1.NASL"], "type": "nessus"}, {"idList": ["DEBIAN:DLA-1449-1:EF247", "DEBIAN:DSA-4355-1:1415E", "DEBIAN:DSA-4348-1:05673"], "type": "debian"}, {"idList": ["CESA-2019:2304"], "type": "centos"}, {"idList": ["OPENSUSE-SU-2018:3015-1", "OPENSUSE-SU-2018:4104-1"], "type": "suse"}, {"idList": ["OPENVAS:1361412562310704348", "OPENVAS:1361412562310876840", "OPENVAS:1361412562310108555", "OPENVAS:1361412562310108556", "OPENVAS:1361412562310108484", "OPENVAS:1361412562310852178", "OPENVAS:1361412562310704355", "OPENVAS:1361412562310877283", "OPENVAS:1361412562310876846", "OPENVAS:1361412562310107444"], "type": "openvas"}]}, "score": {"modified": "2020-03-18T03:06:50", "value": 7.0, "vector": "NONE"}}, "hash": "fcd08521e29a32381e699660941889e32ebc67a587ac04cf1412f62786e50760", "hashmap": [{"hash": "af24fd3fdacb4d500ae9d1e724743016", "key": "modified"}, {"hash": "aef8e4d236cac2cc3d83fd153d894600", "key": "published"}, {"hash": "0eb43bf82f7adc12c2cec66727ec11b0", "key": "cpe"}, {"hash": "5ef7f77010d1551d52a2c059219ab8ab", "key": "cvelist"}, {"hash": "21b1b4b6b08657811a2429d7a1ea001f", "key": "description"}, {"hash": "b0d4f62d84f85f7344d04ed69d1c2399", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "c318bda7791779cd865efa052ac86c4e", "key": "title"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "665191c5ec305a1edb7fc33a99cb2faf", "key": "sourceData"}, {"hash": "3c2ef3f64720f7223f45d365e810735b", "key": "cvss3"}, {"hash": "876f47c4ebc2b9e0dd17afaa22819f2a", "key": "cvss"}, {"hash": "fb990daaf8c857a86bab9781b4ab4b5e", "key": "reporter"}, {"hash": "a73c84181bd67dc5d95ec1015bfba5cb", "key": "references"}, {"hash": "c0cf90e99d60c6b285e8d2d623d43ba5", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/126046", "id": "SUSE_SU-2019-1553-1.NASL", "lastseen": "2020-03-18T03:06:50", "modified": "2020-03-02T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.3", "pluginID": "126046", "published": "2019-06-19T00:00:00", "references": ["https://bugzilla.suse.com/show_bug.cgi?id=1127080", "https://bugzilla.suse.com/show_bug.cgi?id=1117951", "https://www.suse.com/security/cve/CVE-2019-1559/", "https://bugzilla.suse.com/show_bug.cgi?id=1089039", "https://bugzilla.suse.com/show_bug.cgi?id=1110018", "https://bugzilla.suse.com/show_bug.cgi?id=1097158", "https://bugzilla.suse.com/show_bug.cgi?id=1097624", "https://www.suse.com/security/cve/CVE-2018-0734/", "https://bugzilla.suse.com/show_bug.cgi?id=1113652", "https://www.suse.com/security/cve/CVE-2018-5407/", "https://www.suse.com/security/cve/CVE-2018-0737/", "https://bugzilla.suse.com/show_bug.cgi?id=1106197", "https://bugzilla.suse.com/show_bug.cgi?id=1113534", "https://bugzilla.suse.com/show_bug.cgi?id=1101470", "https://www.suse.com/security/cve/CVE-2018-0732/", "https://www.suse.com/security/cve/CVE-2016-8610/", "https://bugzilla.suse.com/show_bug.cgi?id=1098592", "http://www.nessus.org/u?ce5eebf3", "https://bugzilla.suse.com/show_bug.cgi?id=1104789", "https://bugzilla.suse.com/show_bug.cgi?id=1131291"], "reporter": "This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:1553-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126046);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2020/01/10\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\", \"CVE-2019-1559\");\n\n script_name(english:\"SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes 'PortSmash') (bsc#1113534)\n\nCVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown\n(bsc#1127080)\n\nFix One&Done side-channel attack on RSA (bsc#1104789)\n\nReject invalid EC point coordinates (bsc#1131291)\n\nThe 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS\nImplementations (bsc#1117951)\n\nAdd missing error string to CVE-2016-8610 fix (bsc#1110018#c9)\n\nblinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)\n\nNon security fixes: correct the error detection in the fips patch\n(bsc#1106197)\n\nAdd openssl(cli) Provide so the packages that require the openssl\nbinary can require this instead of the new openssl meta package\n(bsc#1101470)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1089039\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097624\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098592\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1101470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106197\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1131291\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8610/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0732/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0737/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-5407/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-1559/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ce5eebf3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2019-1553=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1559\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debugsource-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-32bit-1.0.1i-27.34.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openssl\");\n}\n", "title": "SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)", "type": "nessus", "viewCount": 0}, "differentElements": ["modified"], "edition": 7, "lastseen": "2020-03-18T03:06:50"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:novell:suse_linux:openssl-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo", "p-cpe:/a:novell:suse_linux:openssl", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0", "p-cpe:/a:novell:suse_linux:openssl-debugsource"], "cvelist": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "description": "This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes ", "edition": 2, "enchantments": {"dependencies": {"modified": "2019-11-03T12:26:35", "references": [{"idList": ["SOL11307303", "F5:K43741620", "F5:K21665601", "F5:K49711130", "F5:K18549143", "F5:K43429502", "F5:K11307303"], "type": "f5"}, {"idList": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "type": "cve"}, {"idList": ["RHSA-2019:2304"], "type": "redhat"}, {"idList": ["NESSUS_TNS_2018_17.NASL", "SUSE_SU-2018-3864-1.NASL", "FEDORA_2019-00C25B9379.NASL", "OPENSUSE-2018-1529.NASL", "DEBIAN_DSA-4348.NASL", "DEBIAN_DSA-4355.NASL", "OPENSSL_1_1_0I.NASL", "FEDORA_2019-9A0A7C0986.NASL", "SUSE_SU-2018-4068-1.NASL", "SUSE_SU-2018-4274-1.NASL"], "type": "nessus"}, {"idList": ["OPENSSL_ADVISORY28.ASC", "OPENSSL_ADVISORY27.ASC", "OPENSSL_ADVISORY29.ASC"], "type": "aix"}, {"idList": ["OPENSUSE-SU-2018:3903-1", "OPENSUSE-SU-2018:3015-1", "OPENSUSE-SU-2018:4104-1"], "type": "suse"}, {"idList": ["SMNTC-104442"], "type": "symantec"}, {"idList": ["H1:364964"], "type": "hackerone"}, {"idList": ["ELSA-2019-2304", "ELSA-2019-2471", "ELSA-2018-4248", "ELSA-2018-4254", "ELSA-2019-4754", "ELSA-2018-4249", "ELSA-2018-4253"], "type": "oraclelinux"}, {"idList": ["ALAS-2019-1188"], "type": "amazon"}, {"idList": ["GLSA-201903-10"], "type": "gentoo"}, {"idList": ["SSA-2018-226-01", "SSA-2018-325-01"], "type": "slackware"}, {"idList": ["DEBIAN:DLA-1449-1:EF247", "DEBIAN:DSA-4355-1:1415E", "DEBIAN:DSA-4348-1:05673"], "type": "debian"}, {"idList": ["OPENVAS:1361412562310704348", "OPENVAS:1361412562310108483", "OPENVAS:1361412562310876840", "OPENVAS:1361412562310108555", "OPENVAS:1361412562310108556", "OPENVAS:1361412562310108484", "OPENVAS:1361412562310852178", "OPENVAS:1361412562310704355", "OPENVAS:1361412562310876846", "OPENVAS:1361412562310107444"], "type": "openvas"}, {"idList": ["CESA-2019:2304"], "type": "centos"}]}, "score": {"modified": "2019-11-03T12:26:35", "value": 7.1, "vector": "NONE"}}, "hash": "76fb51be1ede4fa1a2f7df8879e12f6a0d3d702f1da2a67bdf596188f3f765ce", "hashmap": [{"hash": "aef8e4d236cac2cc3d83fd153d894600", "key": "published"}, {"hash": "375f60e9cd08243ac2ba0e942026d5c3", "key": "sourceData"}, {"hash": "0eb43bf82f7adc12c2cec66727ec11b0", "key": "cpe"}, {"hash": "abcf9266f425f12dda38f529cd4a94bc", "key": "modified"}, {"hash": "11426d38796b01509eda4b19dc12a01e", "key": "reporter"}, {"hash": "5ef7f77010d1551d52a2c059219ab8ab", "key": "cvelist"}, {"hash": "21b1b4b6b08657811a2429d7a1ea001f", "key": "description"}, {"hash": "b0d4f62d84f85f7344d04ed69d1c2399", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "c318bda7791779cd865efa052ac86c4e", "key": "title"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "41b62a8aa1ee5c40897717cadc30784a", "key": "cvss"}, {"hash": "a73c84181bd67dc5d95ec1015bfba5cb", "key": "references"}, {"hash": "c0cf90e99d60c6b285e8d2d623d43ba5", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/126046", "id": "SUSE_SU-2019-1553-1.NASL", "lastseen": "2019-11-03T12:26:35", "modified": "2019-11-02T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.3", "pluginID": "126046", "published": "2019-06-19T00:00:00", "references": ["https://bugzilla.suse.com/show_bug.cgi?id=1127080", "https://bugzilla.suse.com/show_bug.cgi?id=1117951", "https://www.suse.com/security/cve/CVE-2019-1559/", "https://bugzilla.suse.com/show_bug.cgi?id=1089039", "https://bugzilla.suse.com/show_bug.cgi?id=1110018", "https://bugzilla.suse.com/show_bug.cgi?id=1097158", "https://bugzilla.suse.com/show_bug.cgi?id=1097624", "https://www.suse.com/security/cve/CVE-2018-0734/", "https://bugzilla.suse.com/show_bug.cgi?id=1113652", "https://www.suse.com/security/cve/CVE-2018-5407/", "https://www.suse.com/security/cve/CVE-2018-0737/", "https://bugzilla.suse.com/show_bug.cgi?id=1106197", "https://bugzilla.suse.com/show_bug.cgi?id=1113534", "https://bugzilla.suse.com/show_bug.cgi?id=1101470", "https://www.suse.com/security/cve/CVE-2018-0732/", "https://www.suse.com/security/cve/CVE-2016-8610/", "https://bugzilla.suse.com/show_bug.cgi?id=1098592", "http://www.nessus.org/u?ce5eebf3", "https://bugzilla.suse.com/show_bug.cgi?id=1104789", "https://bugzilla.suse.com/show_bug.cgi?id=1131291"], "reporter": "This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:1553-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126046);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/09/10 13:51:51\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\", \"CVE-2019-1559\");\n\n script_name(english:\"SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes 'PortSmash') (bsc#1113534)\n\nCVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown\n(bsc#1127080)\n\nFix One&Done side-channel attack on RSA (bsc#1104789)\n\nReject invalid EC point coordinates (bsc#1131291)\n\nThe 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS\nImplementations (bsc#1117951)\n\nAdd missing error string to CVE-2016-8610 fix (bsc#1110018#c9)\n\nblinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)\n\nNon security fixes: correct the error detection in the fips patch\n(bsc#1106197)\n\nAdd openssl(cli) Provide so the packages that require the openssl\nbinary can require this instead of the new openssl meta package\n(bsc#1101470)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1089039\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097624\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098592\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1101470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106197\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1131291\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8610/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0732/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0737/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-5407/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-1559/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ce5eebf3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2019-1553=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debugsource-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-32bit-1.0.1i-27.34.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openssl\");\n}\n", "title": "SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)", "type": "nessus", "viewCount": 0}, "differentElements": ["modified"], "edition": 2, "lastseen": "2019-11-03T12:26:35"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:novell:suse_linux:openssl-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo", "p-cpe:/a:novell:suse_linux:openssl", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0", "p-cpe:/a:novell:suse_linux:openssl-debugsource"], "cvelist": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cvss3": {}, "description": "This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes ", "edition": 6, "enchantments": {"dependencies": {"modified": "2020-02-01T02:28:37", "references": [{"idList": ["OPENSSL_ADVISORY28.ASC", "OPENSSL_ADVISORY27.ASC"], "type": "aix"}, {"idList": ["SOL11307303", "F5:K43741620", "F5:K21665601", "F5:K49711130", "F5:K18549143", "F5:K43429502", "F5:K11307303"], "type": "f5"}, {"idList": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "type": "cve"}, {"idList": ["SMNTC-104442", "SMNTC-105758", "SMNTC-107174"], "type": "symantec"}, {"idList": ["RHSA-2019:2304"], "type": "redhat"}, {"idList": ["PAN-SA-2019-0039"], "type": "paloalto"}, {"idList": ["OPENSUSE-SU-2018:3903-1", "OPENSUSE-SU-2018:3015-1", "OPENSUSE-SU-2018:4104-1"], "type": "suse"}, {"idList": ["H1:364964"], "type": "hackerone"}, {"idList": ["ELSA-2019-2304", "ELSA-2019-2471", "ELSA-2018-4248", "ELSA-2018-4254", "ELSA-2019-4754", "ELSA-2018-4249", "ELSA-2018-4253"], "type": "oraclelinux"}, {"idList": ["ALAS-2019-1188"], "type": "amazon"}, {"idList": ["GLSA-201903-10"], "type": "gentoo"}, {"idList": ["SSA-2018-226-01", "SSA-2018-325-01"], "type": "slackware"}, {"idList": ["FEDORA_2019-DB06EFDEA1.NASL", "NESSUS_TNS_2018_17.NASL", "SUSE_SU-2018-3864-1.NASL", "FEDORA_2019-00C25B9379.NASL", "OPENSUSE-2018-1529.NASL", "DEBIAN_DSA-4348.NASL", "DEBIAN_DSA-4355.NASL", "OPENSSL_1_1_0I.NASL", "SUSE_SU-2018-4068-1.NASL", "SUSE_SU-2018-4274-1.NASL"], "type": "nessus"}, {"idList": ["DEBIAN:DLA-1449-1:EF247", "DEBIAN:DSA-4355-1:1415E", "DEBIAN:DSA-4348-1:05673"], "type": "debian"}, {"idList": ["OPENVAS:1361412562310704348", "OPENVAS:1361412562310876840", "OPENVAS:1361412562310108555", "OPENVAS:1361412562310108556", "OPENVAS:1361412562310108484", "OPENVAS:1361412562310852178", "OPENVAS:1361412562310704355", "OPENVAS:1361412562310877283", "OPENVAS:1361412562310876846", "OPENVAS:1361412562310107444"], "type": "openvas"}]}, "score": {"modified": "2020-02-01T02:28:37", "value": 7.0, "vector": "NONE"}}, "hash": "675be68950c685a7ac6fcb8aceab6b2212fc815e0abf7f915eb166f389d449c0", "hashmap": [{"hash": "aef8e4d236cac2cc3d83fd153d894600", "key": "published"}, {"hash": "0eb43bf82f7adc12c2cec66727ec11b0", "key": "cpe"}, {"hash": "5ef7f77010d1551d52a2c059219ab8ab", "key": "cvelist"}, {"hash": "21b1b4b6b08657811a2429d7a1ea001f", "key": "description"}, {"hash": "b0d4f62d84f85f7344d04ed69d1c2399", "key": "pluginID"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "248ddfee5cc8aa2c1a4fce14baf1e1b1", "key": "modified"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "c318bda7791779cd865efa052ac86c4e", "key": "title"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "665191c5ec305a1edb7fc33a99cb2faf", "key": "sourceData"}, {"hash": "41b62a8aa1ee5c40897717cadc30784a", "key": "cvss"}, {"hash": "fb990daaf8c857a86bab9781b4ab4b5e", "key": "reporter"}, {"hash": "a73c84181bd67dc5d95ec1015bfba5cb", "key": "references"}, {"hash": "c0cf90e99d60c6b285e8d2d623d43ba5", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/126046", "id": "SUSE_SU-2019-1553-1.NASL", "lastseen": "2020-02-01T02:28:37", "modified": "2020-02-02T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.3", "pluginID": "126046", "published": "2019-06-19T00:00:00", "references": ["https://bugzilla.suse.com/show_bug.cgi?id=1127080", "https://bugzilla.suse.com/show_bug.cgi?id=1117951", "https://www.suse.com/security/cve/CVE-2019-1559/", "https://bugzilla.suse.com/show_bug.cgi?id=1089039", "https://bugzilla.suse.com/show_bug.cgi?id=1110018", "https://bugzilla.suse.com/show_bug.cgi?id=1097158", "https://bugzilla.suse.com/show_bug.cgi?id=1097624", "https://www.suse.com/security/cve/CVE-2018-0734/", "https://bugzilla.suse.com/show_bug.cgi?id=1113652", "https://www.suse.com/security/cve/CVE-2018-5407/", "https://www.suse.com/security/cve/CVE-2018-0737/", "https://bugzilla.suse.com/show_bug.cgi?id=1106197", "https://bugzilla.suse.com/show_bug.cgi?id=1113534", "https://bugzilla.suse.com/show_bug.cgi?id=1101470", "https://www.suse.com/security/cve/CVE-2018-0732/", "https://www.suse.com/security/cve/CVE-2016-8610/", "https://bugzilla.suse.com/show_bug.cgi?id=1098592", "http://www.nessus.org/u?ce5eebf3", "https://bugzilla.suse.com/show_bug.cgi?id=1104789", "https://bugzilla.suse.com/show_bug.cgi?id=1131291"], "reporter": "This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:1553-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126046);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2020/01/10\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\", \"CVE-2019-1559\");\n\n script_name(english:\"SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes 'PortSmash') (bsc#1113534)\n\nCVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown\n(bsc#1127080)\n\nFix One&Done side-channel attack on RSA (bsc#1104789)\n\nReject invalid EC point coordinates (bsc#1131291)\n\nThe 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS\nImplementations (bsc#1117951)\n\nAdd missing error string to CVE-2016-8610 fix (bsc#1110018#c9)\n\nblinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)\n\nNon security fixes: correct the error detection in the fips patch\n(bsc#1106197)\n\nAdd openssl(cli) Provide so the packages that require the openssl\nbinary can require this instead of the new openssl meta package\n(bsc#1101470)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1089039\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097624\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098592\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1101470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106197\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1131291\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8610/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0732/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0737/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-5407/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-1559/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ce5eebf3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2019-1553=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1559\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debugsource-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-32bit-1.0.1i-27.34.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openssl\");\n}\n", "title": "SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)", "type": "nessus", "viewCount": 0}, "differentElements": ["cvss", "cvss3", "modified"], "edition": 6, "lastseen": "2020-02-01T02:28:37"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:novell:suse_linux:openssl-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo", "p-cpe:/a:novell:suse_linux:openssl", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0", "p-cpe:/a:novell:suse_linux:openssl-debugsource"], "cvelist": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "description": "This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes ", "edition": 4, "enchantments": {"dependencies": {"modified": "2020-01-01T02:01:40", "references": [{"idList": ["SOL11307303", "F5:K43741620", "F5:K21665601", "F5:K49711130", "F5:K18549143", "F5:K43429502", "F5:K11307303"], "type": "f5"}, {"idList": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "type": "cve"}, {"idList": ["RHSA-2019:2304"], "type": "redhat"}, {"idList": ["NESSUS_TNS_2018_17.NASL", "SUSE_SU-2018-3864-1.NASL", "FEDORA_2019-00C25B9379.NASL", "OPENSUSE-2018-1529.NASL", "DEBIAN_DSA-4348.NASL", "DEBIAN_DSA-4355.NASL", "OPENSSL_1_1_0I.NASL", "FEDORA_2019-9A0A7C0986.NASL", "SUSE_SU-2018-4068-1.NASL", "SUSE_SU-2018-4274-1.NASL"], "type": "nessus"}, {"idList": ["PAN-SA-2019-0039"], "type": "paloalto"}, {"idList": ["OPENSSL_ADVISORY28.ASC", "OPENSSL_ADVISORY27.ASC", "OPENSSL_ADVISORY29.ASC"], "type": "aix"}, {"idList": ["OPENSUSE-SU-2018:3903-1", "OPENSUSE-SU-2018:3015-1", "OPENSUSE-SU-2018:4104-1"], "type": "suse"}, {"idList": ["SMNTC-104442"], "type": "symantec"}, {"idList": ["H1:364964"], "type": "hackerone"}, {"idList": ["ELSA-2019-2304", "ELSA-2019-2471", "ELSA-2018-4248", "ELSA-2018-4254", "ELSA-2019-4754", "ELSA-2018-4249", "ELSA-2018-4253"], "type": "oraclelinux"}, {"idList": ["ALAS-2019-1188"], "type": "amazon"}, {"idList": ["GLSA-201903-10"], "type": "gentoo"}, {"idList": ["SSA-2018-226-01", "SSA-2018-325-01"], "type": "slackware"}, {"idList": ["DEBIAN:DLA-1449-1:EF247", "DEBIAN:DSA-4355-1:1415E", "DEBIAN:DSA-4348-1:05673"], "type": "debian"}, {"idList": ["OPENVAS:1361412562310704348", "OPENVAS:1361412562310108483", "OPENVAS:1361412562310876840", "OPENVAS:1361412562310108555", "OPENVAS:1361412562310108556", "OPENVAS:1361412562310108484", "OPENVAS:1361412562310852178", "OPENVAS:1361412562310704355", "OPENVAS:1361412562310876846", "OPENVAS:1361412562310107444"], "type": "openvas"}, {"idList": ["CESA-2019:2304"], "type": "centos"}]}, "score": {"modified": "2020-01-01T02:01:40", "value": 7.1, "vector": "NONE"}}, "hash": "477ddf84324e9f3bdd46667e2a6e8b2669de2d3d00cfe3278a67aa78c3b6adc3", "hashmap": [{"hash": "aef8e4d236cac2cc3d83fd153d894600", "key": "published"}, {"hash": "375f60e9cd08243ac2ba0e942026d5c3", "key": "sourceData"}, {"hash": "0eb43bf82f7adc12c2cec66727ec11b0", "key": "cpe"}, {"hash": "11426d38796b01509eda4b19dc12a01e", "key": "reporter"}, {"hash": "2249940a684898a70237266de5d6dd6c", "key": "modified"}, {"hash": "5ef7f77010d1551d52a2c059219ab8ab", "key": "cvelist"}, {"hash": "21b1b4b6b08657811a2429d7a1ea001f", "key": "description"}, {"hash": "b0d4f62d84f85f7344d04ed69d1c2399", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "c318bda7791779cd865efa052ac86c4e", "key": "title"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "41b62a8aa1ee5c40897717cadc30784a", "key": "cvss"}, {"hash": "a73c84181bd67dc5d95ec1015bfba5cb", "key": "references"}, {"hash": "c0cf90e99d60c6b285e8d2d623d43ba5", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/126046", "id": "SUSE_SU-2019-1553-1.NASL", "lastseen": "2020-01-01T02:01:40", "modified": "2020-01-02T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.3", "pluginID": "126046", "published": "2019-06-19T00:00:00", "references": ["https://bugzilla.suse.com/show_bug.cgi?id=1127080", "https://bugzilla.suse.com/show_bug.cgi?id=1117951", "https://www.suse.com/security/cve/CVE-2019-1559/", "https://bugzilla.suse.com/show_bug.cgi?id=1089039", "https://bugzilla.suse.com/show_bug.cgi?id=1110018", "https://bugzilla.suse.com/show_bug.cgi?id=1097158", "https://bugzilla.suse.com/show_bug.cgi?id=1097624", "https://www.suse.com/security/cve/CVE-2018-0734/", "https://bugzilla.suse.com/show_bug.cgi?id=1113652", "https://www.suse.com/security/cve/CVE-2018-5407/", "https://www.suse.com/security/cve/CVE-2018-0737/", "https://bugzilla.suse.com/show_bug.cgi?id=1106197", "https://bugzilla.suse.com/show_bug.cgi?id=1113534", "https://bugzilla.suse.com/show_bug.cgi?id=1101470", "https://www.suse.com/security/cve/CVE-2018-0732/", "https://www.suse.com/security/cve/CVE-2016-8610/", "https://bugzilla.suse.com/show_bug.cgi?id=1098592", "http://www.nessus.org/u?ce5eebf3", "https://bugzilla.suse.com/show_bug.cgi?id=1104789", "https://bugzilla.suse.com/show_bug.cgi?id=1131291"], "reporter": "This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:1553-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126046);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/09/10 13:51:51\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\", \"CVE-2019-1559\");\n\n script_name(english:\"SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes 'PortSmash') (bsc#1113534)\n\nCVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown\n(bsc#1127080)\n\nFix One&Done side-channel attack on RSA (bsc#1104789)\n\nReject invalid EC point coordinates (bsc#1131291)\n\nThe 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS\nImplementations (bsc#1117951)\n\nAdd missing error string to CVE-2016-8610 fix (bsc#1110018#c9)\n\nblinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)\n\nNon security fixes: correct the error detection in the fips patch\n(bsc#1106197)\n\nAdd openssl(cli) Provide so the packages that require the openssl\nbinary can require this instead of the new openssl meta package\n(bsc#1101470)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1089039\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097624\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098592\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1101470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106197\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1131291\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8610/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0732/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0737/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-5407/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-1559/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ce5eebf3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2019-1553=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debugsource-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-32bit-1.0.1i-27.34.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openssl\");\n}\n", "title": "SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)", "type": "nessus", "viewCount": 0}, "differentElements": ["reporter", "sourceData"], "edition": 4, "lastseen": "2020-01-01T02:01:40"}, {"bulletin": {"bulletinFamily": "scanner", "cpe": ["p-cpe:/a:novell:suse_linux:openssl-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo", "p-cpe:/a:novell:suse_linux:openssl", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0", "p-cpe:/a:novell:suse_linux:openssl-debugsource"], "cvelist": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "description": "This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes ", "edition": 5, "enchantments": {"dependencies": {"modified": "2020-01-11T09:53:20", "references": [{"idList": ["SOL11307303", "F5:K43741620", "F5:K21665601", "F5:K49711130", "F5:K18549143", "F5:K43429502", "F5:K11307303"], "type": "f5"}, {"idList": ["CVE-2018-0732", "CVE-2018-0734", "CVE-2018-5407", "CVE-2016-8610", "CVE-2019-1559", "CVE-2018-0737"], "type": "cve"}, {"idList": ["SMNTC-104442", "SMNTC-105758", "SMNTC-107174"], "type": "symantec"}, {"idList": ["RHSA-2019:2304"], "type": "redhat"}, {"idList": ["PAN-SA-2019-0039"], "type": "paloalto"}, {"idList": ["OPENSSL_ADVISORY28.ASC", "OPENSSL_ADVISORY27.ASC", "OPENSSL_ADVISORY29.ASC"], "type": "aix"}, {"idList": ["OPENSUSE-SU-2018:3903-1", "OPENSUSE-SU-2018:3015-1", "OPENSUSE-SU-2018:4104-1"], "type": "suse"}, {"idList": ["H1:364964"], "type": "hackerone"}, {"idList": ["ELSA-2019-2304", "ELSA-2019-2471", "ELSA-2018-4248", "ELSA-2018-4254", "ELSA-2019-4754", "ELSA-2018-4249", "ELSA-2018-4253"], "type": "oraclelinux"}, {"idList": ["ALAS-2019-1188"], "type": "amazon"}, {"idList": ["GLSA-201903-10"], "type": "gentoo"}, {"idList": ["SSA-2018-226-01", "SSA-2018-325-01"], "type": "slackware"}, {"idList": ["FEDORA_2019-DB06EFDEA1.NASL", "NESSUS_TNS_2018_17.NASL", "SUSE_SU-2018-3864-1.NASL", "FEDORA_2019-00C25B9379.NASL", "OPENSUSE-2018-1529.NASL", "DEBIAN_DSA-4348.NASL", "DEBIAN_DSA-4355.NASL", "OPENSSL_1_1_0I.NASL", "SUSE_SU-2018-4068-1.NASL", "SUSE_SU-2018-4274-1.NASL"], "type": "nessus"}, {"idList": ["DEBIAN:DLA-1449-1:EF247", "DEBIAN:DSA-4355-1:1415E", "DEBIAN:DSA-4348-1:05673"], "type": "debian"}, {"idList": ["OPENVAS:1361412562310704348", "OPENVAS:1361412562310108483", "OPENVAS:1361412562310876840", "OPENVAS:1361412562310108555", "OPENVAS:1361412562310108556", "OPENVAS:1361412562310108484", "OPENVAS:1361412562310852178", "OPENVAS:1361412562310704355", "OPENVAS:1361412562310876846", "OPENVAS:1361412562310107444"], "type": "openvas"}, {"idList": ["CESA-2019:2304"], "type": "centos"}]}, "score": {"modified": "2020-01-11T09:53:20", "value": 7.0, "vector": "NONE"}}, "hash": "8915488a51c9869f24a566fd1d6a8134547e84153547112da5b6926826881708", "hashmap": [{"hash": "aef8e4d236cac2cc3d83fd153d894600", "key": "published"}, {"hash": "0eb43bf82f7adc12c2cec66727ec11b0", "key": "cpe"}, {"hash": "2249940a684898a70237266de5d6dd6c", "key": "modified"}, {"hash": "5ef7f77010d1551d52a2c059219ab8ab", "key": "cvelist"}, {"hash": "21b1b4b6b08657811a2429d7a1ea001f", "key": "description"}, {"hash": "b0d4f62d84f85f7344d04ed69d1c2399", "key": "pluginID"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "c318bda7791779cd865efa052ac86c4e", "key": "title"}, {"hash": "71a40666da62ba38d22539c8277870c7", "key": "naslFamily"}, {"hash": "665191c5ec305a1edb7fc33a99cb2faf", "key": "sourceData"}, {"hash": "41b62a8aa1ee5c40897717cadc30784a", "key": "cvss"}, {"hash": "fb990daaf8c857a86bab9781b4ab4b5e", "key": "reporter"}, {"hash": "a73c84181bd67dc5d95ec1015bfba5cb", "key": "references"}, {"hash": "c0cf90e99d60c6b285e8d2d623d43ba5", "key": "href"}], "history": [], "href": "https://www.tenable.com/plugins/nessus/126046", "id": "SUSE_SU-2019-1553-1.NASL", "lastseen": "2020-01-11T09:53:20", "modified": "2020-01-02T00:00:00", "naslFamily": "SuSE Local Security Checks", "objectVersion": "1.3", "pluginID": "126046", "published": "2019-06-19T00:00:00", "references": ["https://bugzilla.suse.com/show_bug.cgi?id=1127080", "https://bugzilla.suse.com/show_bug.cgi?id=1117951", "https://www.suse.com/security/cve/CVE-2019-1559/", "https://bugzilla.suse.com/show_bug.cgi?id=1089039", "https://bugzilla.suse.com/show_bug.cgi?id=1110018", "https://bugzilla.suse.com/show_bug.cgi?id=1097158", "https://bugzilla.suse.com/show_bug.cgi?id=1097624", "https://www.suse.com/security/cve/CVE-2018-0734/", "https://bugzilla.suse.com/show_bug.cgi?id=1113652", "https://www.suse.com/security/cve/CVE-2018-5407/", "https://www.suse.com/security/cve/CVE-2018-0737/", "https://bugzilla.suse.com/show_bug.cgi?id=1106197", "https://bugzilla.suse.com/show_bug.cgi?id=1113534", "https://bugzilla.suse.com/show_bug.cgi?id=1101470", "https://www.suse.com/security/cve/CVE-2018-0732/", "https://www.suse.com/security/cve/CVE-2016-8610/", "https://bugzilla.suse.com/show_bug.cgi?id=1098592", "http://www.nessus.org/u?ce5eebf3", "https://bugzilla.suse.com/show_bug.cgi?id=1104789", "https://bugzilla.suse.com/show_bug.cgi?id=1131291"], "reporter": "This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:1553-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126046);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2020/01/10\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\", \"CVE-2019-1559\");\n\n script_name(english:\"SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes 'PortSmash') (bsc#1113534)\n\nCVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown\n(bsc#1127080)\n\nFix One&Done side-channel attack on RSA (bsc#1104789)\n\nReject invalid EC point coordinates (bsc#1131291)\n\nThe 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS\nImplementations (bsc#1117951)\n\nAdd missing error string to CVE-2016-8610 fix (bsc#1110018#c9)\n\nblinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)\n\nNon security fixes: correct the error detection in the fips patch\n(bsc#1106197)\n\nAdd openssl(cli) Provide so the packages that require the openssl\nbinary can require this instead of the new openssl meta package\n(bsc#1101470)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1089039\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097624\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098592\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1101470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106197\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1131291\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8610/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0732/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0737/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-5407/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-1559/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ce5eebf3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2019-1553=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1559\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debugsource-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-32bit-1.0.1i-27.34.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openssl\");\n}\n", "title": "SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)", "type": "nessus", "viewCount": 0}, "differentElements": ["modified"], "edition": 5, "lastseen": "2020-01-11T09:53:20"}], "edition": 8, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "0eb43bf82f7adc12c2cec66727ec11b0"}, {"key": "cvelist", "hash": "5ef7f77010d1551d52a2c059219ab8ab"}, {"key": "cvss", "hash": "876f47c4ebc2b9e0dd17afaa22819f2a"}, {"key": "cvss3", "hash": "3c2ef3f64720f7223f45d365e810735b"}, {"key": "description", "hash": "21b1b4b6b08657811a2429d7a1ea001f"}, {"key": "href", "hash": "c0cf90e99d60c6b285e8d2d623d43ba5"}, {"key": "modified", "hash": "0658bb008399a687b703257886c78457"}, {"key": "naslFamily", "hash": "71a40666da62ba38d22539c8277870c7"}, {"key": "pluginID", "hash": "b0d4f62d84f85f7344d04ed69d1c2399"}, {"key": "published", "hash": "aef8e4d236cac2cc3d83fd153d894600"}, {"key": "references", "hash": "a73c84181bd67dc5d95ec1015bfba5cb"}, {"key": "reporter", "hash": "fb990daaf8c857a86bab9781b4ab4b5e"}, {"key": "sourceData", "hash": "665191c5ec305a1edb7fc33a99cb2faf"}, {"key": "title", "hash": "c318bda7791779cd865efa052ac86c4e"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "d2b9c2981e9823602ff55742482e6d4393456f0525f36c3de9378177318ca369", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2016-8610", "CVE-2019-1559", "CVE-2018-5407", "CVE-2018-0737", "CVE-2018-0732", "CVE-2018-0734"]}, {"type": "f5", "idList": ["F5:K11307303", "SOL11307303", "F5:K18549143", "F5:K21665601", "F5:K43429502", "F5:K43741620", "F5:K49711130"]}, {"type": "nessus", "idList": ["SUSE_SU-2018-3864-1.NASL", "NESSUS_TNS_2018_17.NASL", "DEBIAN_DSA-4355.NASL", "DEBIAN_DSA-4348.NASL", "SUSE_SU-2018-4274-1.NASL", "SUSE_SU-2018-4068-1.NASL", "OPENSUSE-2018-1529.NASL", "OPENSSL_1_1_0I.NASL", "FEDORA_2019-00C25B9379.NASL", "FEDORA_2019-DB06EFDEA1.NASL"]}, {"type": "symantec", "idList": ["SMNTC-107174", "SMNTC-104442", "SMNTC-105758"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310704355", "OPENVAS:1361412562310704348", "OPENVAS:1361412562310107444", "OPENVAS:1361412562310852178", "OPENVAS:1361412562310108555", "OPENVAS:1361412562310108556", "OPENVAS:1361412562310876846", "OPENVAS:1361412562310876840", "OPENVAS:1361412562310877283", "OPENVAS:1361412562310108484"]}, {"type": "debian", "idList": ["DEBIAN:DSA-4355-1:1415E", "DEBIAN:DSA-4348-1:05673", "DEBIAN:DLA-1449-1:EF247"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2018:4104-1", "OPENSUSE-SU-2018:3015-1"]}, {"type": "aix", "idList": ["OPENSSL_ADVISORY27.ASC", "OPENSSL_ADVISORY28.ASC", "OPENSSL_ADVISORY29.ASC"]}, {"type": "paloalto", "idList": ["PAN-SA-2019-0039"]}, {"type": "hackerone", "idList": ["H1:364964"]}, {"type": "oraclelinux", "idList": ["ELSA-2019-2304", "ELSA-2019-4754", "ELSA-2019-2471", "ELSA-2018-4248", "ELSA-2018-4249", "ELSA-2018-4253", "ELSA-2018-4254"]}, {"type": "amazon", "idList": ["ALAS-2019-1188"]}, {"type": "gentoo", "idList": ["GLSA-201903-10"]}, {"type": "slackware", "idList": ["SSA-2018-226-01"]}, {"type": "redhat", "idList": ["RHSA-2019:2304"]}, {"type": "centos", "idList": ["CESA-2019:2304"]}], "modified": "2020-04-01T02:57:11"}, "score": {"value": 7.0, "vector": "NONE", "modified": "2020-04-01T02:57:11"}, "vulnersScore": 7.0}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:1553-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(126046);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2020/01/10\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\", \"CVE-2019-1559\");\n\n script_name(english:\"SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openssl fixes the following issues :\n\nCVE-2018-0732: Reject excessively large primes in DH key generation\n(bsc#1097158)\n\nCVE-2018-0734: Timing vulnerability in DSA signature generation\n(bsc#1113652)\n\nCVE-2018-0737: Cache timing vulnerability in RSA Key Generation\n(bsc#1089039)\n\nCVE-2018-5407: Elliptic curve scalar multiplication timing attack\ndefenses (fixes 'PortSmash') (bsc#1113534)\n\nCVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown\n(bsc#1127080)\n\nFix One&Done side-channel attack on RSA (bsc#1104789)\n\nReject invalid EC point coordinates (bsc#1131291)\n\nThe 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS\nImplementations (bsc#1117951)\n\nAdd missing error string to CVE-2016-8610 fix (bsc#1110018#c9)\n\nblinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)\n\nNon security fixes: correct the error detection in the fips patch\n(bsc#1106197)\n\nAdd openssl(cli) Provide so the packages that require the openssl\nbinary can require this instead of the new openssl meta package\n(bsc#1101470)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1089039\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097158\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1097624\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1098592\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1101470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106197\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1117951\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1127080\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1131291\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8610/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0732/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0737/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-5407/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2019-1559/\"\n );\n # https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ce5eebf3\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2019-1553=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1559\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/06/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/06/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debuginfo-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"openssl-debugsource-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-debuginfo-32bit-1.0.1i-27.34.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl1_0_0-hmac-32bit-1.0.1i-27.34.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openssl\");\n}\n", "naslFamily": "SuSE Local Security Checks", "pluginID": "126046", "cpe": ["p-cpe:/a:novell:suse_linux:openssl-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo", "p-cpe:/a:novell:suse_linux:openssl", "p-cpe:/a:novell:suse_linux:libopenssl1_0_0", "p-cpe:/a:novell:suse_linux:openssl-debugsource"], "scheme": null, "cvss3": {"score": 5.9, "vector": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}

{"cve": [{"lastseen": "2020-02-18T13:08:08", "bulletinFamily": "NVD", "description": "A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.", "modified": "2019-07-23T23:15:00", "id": "CVE-2016-8610", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-8610", "published": "2017-11-13T22:29:00", "title": "CVE-2016-8610", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-16T12:49:01", "bulletinFamily": "NVD", "description": "If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).", "modified": "2019-05-22T00:29:00", "id": "CVE-2019-1559", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1559", "published": "2019-02-27T23:29:00", "title": "CVE-2019-1559", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-01-16T13:34:10", "bulletinFamily": "NVD", "description": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).", "modified": "2019-06-11T22:29:00", "id": "CVE-2018-0734", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-0734", "published": "2018-10-30T12:29:00", "title": "CVE-2018-0734", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-01-16T13:34:53", "bulletinFamily": "NVD", "description": "Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.", "modified": "2019-07-23T23:15:00", "id": "CVE-2018-5407", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5407", "published": "2018-11-15T21:29:00", "title": "CVE-2018-5407", "type": "cve", "cvss": {"score": 1.9, "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-11-21T12:35:42", "bulletinFamily": "NVD", "description": "The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).", "modified": "2019-10-03T00:03:00", "id": "CVE-2018-0737", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-0737", "published": "2018-04-16T18:29:00", "title": "CVE-2018-0737", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-10-17T11:37:02", "bulletinFamily": "NVD", "description": "During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).", "modified": "2019-05-30T18:29:00", "id": "CVE-2018-0732", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-0732", "published": "2018-06-12T13:29:00", "title": "CVE-2018-0732", "type": "cve", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "f5": [{"lastseen": "2020-04-06T04:41:04", "bulletinFamily": "software", "description": "\nF5 Product Development has assigned ID 410742 (ARX) to this vulnerability.\n\nTo determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table.\n\nProduct | Versions known to be vulnerable | Versions known to be not vulnerable | Severity | Vulnerable component or feature \n---|---|---|---|--- \nBIG-IP LTM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4 | Not vulnerable | None \nBIG-IP AAM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 | Not vulnerable | None \nBIG-IP AFM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 | Not vulnerable | None \nBIG-IP Analytics | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1 | Not vulnerable | None \nBIG-IP APM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4 | Not vulnerable | None \nBIG-IP ASM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4 | Not vulnerable | None \nBIG-IP DNS | None | 13.0.0 \n12.0.0 - 12.1.2 | Not vulnerable | None \nBIG-IP Edge Gateway | None | 11.2.1 \n10.2.1 - 10.2.4 | Not vulnerable | None \nBIG-IP GTM | None | 11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4 | Not vulnerable | None \nBIG-IP Link Controller | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 \n11.2.1 \n10.2.1 - 10.2.4 | Not vulnerable | None \nBIG-IP PEM | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.4.0 - 11.6.1 | Not vulnerable | None \nBIG-IP PSM | None | 11.4.0 - 11.4.1 \n10.2.1 - 10.2.4 | Not vulnerable | None \nBIG-IP WebAccelerator | None | 11.2.1 \n10.2.1 - 10.2.4 | Not vulnerable | None \nBIG-IP WebSafe | None | 13.0.0 \n12.0.0 - 12.1.2 \n11.6.0 - 11.6.1 | Not vulnerable | None \nARX | 6.2.0 - 6.4.0 | None | Low | OpenSSL via the ARX GUI \nEnterprise Manager | None | 3.1.1 | Not vulnerable | None \nBIG-IQ Cloud | None | 4.0.0 - 4.5.0 | Not vulnerable | None \nBIG-IQ Device | None | 4.2.0 - 4.5.0 | Not vulnerable | None \nBIG-IQ Security | None | 4.0.0 - 4.5.0 | Not vulnerable | None \nBIG-IQ ADC | None | 4.5.0 | Not vulnerable | None \nBIG-IQ Centralized Management | None | 5.0.0 - 5.1.0 \n4.6.0 | Not vulnerable | None \nBIG-IQ Cloud and Orchestration | None | 1.0.0 | Not vulnerable | None \nF5 iWorkflow | None | 2.0.0 - 2.0.1 | Not vulnerable | None \nLineRate | None | 2.5.0 - 2.6.1 | Not vulnerable | None \nTraffix SDC | None | 5.0.0 - 5.1.0 \n4.0.0 - 4.4.0 | Not vulnerable | None\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Versions known to be not vulnerable** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nTo mitigate this vulnerability, you should permit access to the ARX GUI only over a secure network.\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n", "modified": "2019-05-09T00:24:00", "published": "2016-11-22T01:41:00", "id": "F5:K11307303", "href": "https://support.f5.com/csp/article/K11307303", "title": "OpenSSL vulnerability CVE-2016-8610", "type": "f5", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2016-11-28T21:27:12", "bulletinFamily": "software", "description": "Vulnerability Recommended Actions\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Versions known to be not vulnerable** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nTo mitigate this vulnerability, you should permit access to the ARX GUI only over a secure network.\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n", "modified": "2016-11-21T00:00:00", "published": "2016-11-21T00:00:00", "href": "http://support.f5.com/kb/en-us/solutions/public/k/11/sol11307303.html", "id": "SOL11307303", "type": "f5", "title": "SOL11307303 - OpenSSL vulnerability CVE-2016-8610", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2020-04-06T04:41:57", "bulletinFamily": "software", "description": "\nF5 Product Development has assigned IDs 761725 and 765053 (BIG-IP and Enterprise Manager), and CPF-25069 and CPF-25070 (Traffix) to this vulnerability. Additionally, [BIG-IP iHealth](<https://www.f5.com/services/support/support-offerings/big-ip-ihealth-diagnostic-tool>) may list Heuristic H18549143 on the **Diagnostics** &gt; **Identified** &gt; **Medium** page.\n\nTo determine if your product and version have been evaluated for this vulnerability, refer to the **Applies to (see versions)** box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>).\n\nProduct | Branch | Versions known to be vulnerable | Fixes introduced in | Severity | CVSSv3 score1 | Vulnerable component or feature \n---|---|---|---|---|---|--- \nBIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) | 15.x | 15.0.0 - 15.0.1 | None | Medium | [6.8](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N>) | iRulesLX is exposed to this vulnerability because NodeJS uses the OpenSSL library \n14.x | 14.1.0 - 14.1.2 | None \n13.x | None | Not applicable \n12.x | None | Not applicable \n11.x | None | Not applicable \n15.x | 15.0.0 - 15.0.1 | None | Medium | [6.8](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N>) | iAppsLX is exposed to this vulnerability because NodeJS uses the OpenSSL library \n14.x | 14.0.0 - 14.1.2 | None \n13.x | 13.0.0 - 13.1.1 | None \n12.x | 12.1.0 - 12.1.4 | None \n11.x | None | Not applicable \nEnterprise Manager | 3.x | None | Not applicable | Not vulnerable | None | None \nBIG-IQ Centralized Management | 6.x | 6.0.0 - 6.1.0 | None | Medium | [6.8](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N>) | NodeJS \n5.x | None | Not applicable | Not vulnerable | None | None \nF5 iWorkflow | 2.x | None | Not applicable | Not vulnerable | None | None \nTraffix SDC | 5.x | 5.0.0 - 5.1.0 | None | Medium | [6.8](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N>) | OpenSSL \n4.x | 4.4.0 | None \n \n1The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Fixes introduced in** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nNone\n\n * [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>)\n * [K41942608: Overview of Security Advisory articles](<https://support.f5.com/csp/article/K41942608>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K9502: BIG-IP hotfix and point release matrix](<https://support.f5.com/csp/article/K9502>)\n * [K15113: BIG-IQ hotfix and point release matrix](<https://support.f5.com/csp/article/K15113>)\n * [K48955220: Installing an OPSWAT Endpoint Security update on BIG-IP APM systems (11.4.x and later)](<https://support.f5.com/csp/article/K48955220>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K21232150: Considerations for upgrading BIG-IQ or F5 iWorkflow systems](<https://support.f5.com/csp/article/K21232150>)\n", "modified": "2019-08-27T19:48:00", "published": "2019-03-19T20:41:00", "id": "F5:K18549143", "href": "https://support.f5.com/csp/article/K18549143", "title": "OpenSSL vulnerability CVE-2019-1559", "type": "f5", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-04-06T04:41:56", "bulletinFamily": "software", "description": "\nF5 Product Development has assigned IDs 724680 (BIG-IP), ID 724857 (Enterprise Manager), ID 724858 (BIG-IQ), and CPF-24923 and CPF-24924 (Traffix SDC) to this vulnerability. Additionally, [BIG-IP iHealth](<https://www.f5.com/services/support/support-offerings/big-ip-ihealth-diagnostic-tool>) may list Heuristic H21665601 on the **Diagnostics** &gt; **Identified** &gt; **Medium** page.\n\nTo determine if your product and version have been evaluated for this vulnerability, refer to the **Applies to (see versions)** box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>).\n\nProduct | Branch | Versions known to be vulnerable | Fixes introduced in | Severity | CVSSv3 score1 | Vulnerable component or feature \n---|---|---|---|---|---|--- \nBIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) | 15.x | None | 15.0.0 | Medium | [4.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L>) | OpenSSL \n14.x | 14.0.0 - 14.1.0 | 14.1.0.2 \n14.0.1.1 \n13.x | 13.0.0 - 13.1.1 | 13.1.1.2 \n12.x | 12.1.0 - 12.1.3 | 12.1.4 \n11.x | 11.2.1 - 11.6.3 | 11.6.3.3 \n11.5.9 \nARX | 6.x | None | Not applicable | Not vulnerable | None | None \nEnterprise Manager | 3.x | 3.1.1 | None | Medium | [4.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L>) | OpenSSL \nBIG-IQ Centralized Management | 6.x | 6.0.0 | None | Medium | [4.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L>) | OpenSSL \n5.x | 5.0.0 - 5.4.0 | None \n4.x | 4.6.0 | None \nBIG-IQ Cloud and Orchestration | 1.x | 1.0.0 | None | Medium | [4.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L>) | OpenSSL \nF5 iWorkflow | 2.x | 2.1.0 - 2.3.0 | None | Medium | [4.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L>) | OpenSSL \nTraffix SDC | 5.x | 5.0.0 - 5.1.0 | None | Medium | [4.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L>) | OpenSSL \n4.x | 4.4.0 | None \n \n1The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Fixes introduced in** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nTo mitigate this vulnerability, you should limit connections to SSL/TLS servers only on trusted networks. To protect vulnerable clients, you can configure the BIG-IP system to proxy outbound SSL connections. For more information about proxying outbound SSL connections, refer to the following documents:\n\n * The **Implementing SSL Forward Proxy on a Single BIG-IP System** chapter of the _**BIG-IP System: SSL Administration**_ manual\n * The _**BIG-IP Access Policy Manager: Secure Web Gateway**_ manual \n\n**Note**: For information about how to locate F5 product manuals, refer to [K12453464: Finding product documentation on AskF5](<https://support.f5.com/csp/article/K12453464>).\n\n * [K71174564: Overview of F5 SSL Orchestrator](<https://support.f5.com/csp/article/K71174564>)\n\n * [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>)\n * [K41942608: Overview of Security Advisory articles](<https://support.f5.com/csp/article/K41942608>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K9502: BIG-IP hotfix and point release matrix](<https://support.f5.com/csp/article/K9502>)\n * [K15113: BIG-IQ hotfix and point release matrix](<https://support.f5.com/csp/article/K15113>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K21232150: Considerations for upgrading BIG-IQ or F5 iWorkflow systems](<https://support.f5.com/csp/article/K21232150>)\n", "modified": "2019-10-25T16:36:00", "published": "2018-07-21T01:20:00", "id": "F5:K21665601", "href": "https://support.f5.com/csp/article/K21665601", "title": "OpenSSL vulnerability CVE-2018-0732", "type": "f5", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-12-20T22:23:22", "bulletinFamily": "software", "description": "\nF5 Product Development has assigned CPF-24906 and CPF-24907 (Traffix SDC) to this vulnerability.\n\nTo determine if your product and version have been evaluated for this vulnerability, refer to the **Applies to (see versions)** box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>).\n\nProduct | Branch | Versions known to be vulnerable | Fixes introduced in | Severity | CVSSv3 score1 | Vulnerable component or feature \n---|---|---|---|---|---|--- \nBIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) | 13.x | None | Not applicable | Not vulnerable2 | None | None \n12.x | None | Not applicable \n11.x | None | Not applicable \nARX | 6.x | None | Not applicable | Not vulnerable | None | None \nEnterprise Manager | 3.x | None | Not applicable | Not vulnerable2 | None | None \nBIG-IQ Centralized Management | 5.x | None | Not applicable | Not vulnerable2 | None | None \n4.x | None | Not applicable \nBIG-IQ Cloud and Orchestration | 1.x | None | Not applicable | Not vulnerable2 | None | None \nF5 iWorkflow | 2.x | None | Not applicable | Not vulnerable2 | None | None \nLineRate | 2.x | None | Not applicable | Not vulnerable | None | None \nTraffix SDC | 5.x | 5.0.0 - 5.1.0 | None | Low | [3.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N>) | OpenSSL RSA key generation \n4.x | 4.4.0 | None \n \n1 The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.\n\n2 The specified products contain the affected code. However, F5 identifies the vulnerability status as Not vulnerable because the attacker cannot exploit the code in default, standard, or recommended configurations.\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Fixes introduced in** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nNone\n\n * [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>)\n * [K41942608: Overview of Security Advisory articles](<https://support.f5.com/csp/article/K41942608>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K167: Downloading software and firmware from F5](<https://support.f5.com/csp/article/K167>)\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n", "modified": "2018-05-31T08:00:00", "published": "2018-05-31T08:00:00", "id": "F5:K43429502", "href": "https://support.f5.com/csp/article/K43429502", "title": "OpenSSL RSA key generation vulnerability CVE-2018-0737", "type": "f5", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-04-06T04:40:59", "bulletinFamily": "software", "description": "\nF5 Product Development has assigned CPF-25030 (Traffix) to this vulnerability.\n\nTo determine if your product and version have been evaluated for this vulnerability, refer to the **Applies to (see versions)** box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>).\n\nProduct | Branch | Versions known to be vulnerable | Fixes introduced in | Severity | CVSSv3 score1 | Vulnerable component or feature \n---|---|---|---|---|---|--- \nBIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) | 14.x2 | None | Not applicable | Not vulnerable | None | None \n13.x | None | Not applicable \n12.x | None | Not applicable \n11.x | None | Not applicable \nEnterprise Manager | 3.x | None | Not applicable | Not vulnerable | None | None \nBIG-IQ Centralized Management | 6.x | None | Not applicable | Not vulnerable | None | None \n5.x | None | Not applicable \nF5 iWorkflow | 2.x | None | Not applicable | Not vulnerable | None | None \nTraffix SDC | 5.x | 5.0.0 - 5.1.0 | None | Medium | [5.1](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N>) | OpenSSL \n4.x | 4.4.0 | None \n \n1The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.\n\n2 BIG-IP 14.1.0 contains the affected code. However, F5 identifies the vulnerability status as Not vulnerable because the attacker would need to be logged in to the affected system with a local administrator account to exploit it.\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Fixes introduced in** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nNone\n\n * [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>)\n * [K41942608: Overview of Security Advisory articles](<https://support.f5.com/csp/article/K41942608>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n", "modified": "2018-12-15T03:22:00", "published": "2018-12-15T03:22:00", "id": "F5:K43741620", "href": "https://support.f5.com/csp/article/K43741620", "title": "OpenSSL vulnerabilities CVE-2018-0734 and CVE-2018-0735", "type": "f5", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-04-06T04:41:58", "bulletinFamily": "software", "description": "\nF5 Product Development has assigned IDs 751143 and 751152 (BIG-IP), ID 751143-7 (BIG-IQ Centralized Management), ID 751143-8 (F5 iWorkflow), ID 751143-9 (Enterprise Manager), and CPF-25013 and CPF-25014 (Traffix) to this vulnerability.\n\nTo determine if your product and version have been evaluated for this vulnerability, refer to the **Applies to (see versions)** box. To determine if your release is known to be vulnerable, the components or features that are affected by the vulnerability, and for information about releases, point releases, or hotfixes that address the vulnerability, refer to the following table. For more information about security advisory versioning, refer to [K51812227: Understanding Security Advisory versioning](<https://support.f5.com/csp/article/K51812227>).\n\nProduct | Branch | Versions known to be vulnerable | Fixes introduced in | Severity | CVSSv3 score1 | Vulnerable component or feature \n---|---|---|---|---|---|--- \nBIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator) | 15.x | None | 15.0.0 | Medium | [5.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N>) | OpenSSL EC algorithm (LTM SSL profiles, iApps LX, iRules LX, big3d, Configuration utility), CPU \n14.x | 14.0.0 - 14.1.2 | 14.1.2.1 \n13.x | 13.0.0 - 13.1.3 | None \n12.x | 12.1.0 - 12.1.5 | None \n11.x | 11.2.1 - 11.6.5 | None \nEnterprise Manager | 3.x | 3.1.1 | None | Medium | [5.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N>) | OpenSSL EC algorithm, CPU \nBIG-IQ Centralized Management | 6.x | 6.0.0 - 6.0.1 | None | Medium | [5.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N>) | OpenSSL EC algorithm, CPU \n5.x | 5.0.0 - 5.4.0 | None \nF5 iWorkflow | 2.x | 2.3.0 | None | Medium | [5.3](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N>) | OpenSSL EC algorithm, CPU \nTraffix SDC | 5.x | 5.0.0 - 5.1.0 | None | Medium | [4.8](<https://first.org/cvss/calculator/3.0#CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N>) | OpenSSL EC algorithm, CPU \n4.x | 4.4.0 | None \n \n1The CVSSv3 score link takes you to a resource outside of AskF5, and it is possible that the document may be removed without our knowledge.\n\nVulnerable platforms\n\nBIG-IP\n\n * Virtual Edition\n\nThe following platforms when vCMP guests are deployed:\n\n * VIPRION B2100\n * VIPRION B2150\n * VIPRION B2250\n * VIPRION B4200\n * VIPRION B4300 blade in the 4400(J100) 4-slot chassis\n * VIPRION B4300 blade in the 4480(J102) 4-slot chassis\n * VIPRION B4300 blade in the 4800(S100) 8-slot chassis\n * VIPRION B4450 blade in the 4480(J102) 4-slot chassis\n * VIPRION B4450 blade in the 4800(S100) 8-slot chassis\n * BIG-IP 5200v\n * BIG-IP 5250v\n * BIG-IP 7200v\n * BIG-IP 7250v\n * BIG-IP 7255v\n * BIG-IP 10200v\n * BIG-IP 10250v\n * BIG-IP 10350v\n * BIG-IP 12250v\n * BIG-IP i5800\n * BIG-IP i5820-DF (FIPS)\n * BIG-IP i7800\n * BIG-IP i7820-DF (FIPS)\n * BIG-IP i10800\n * BIG-IP i11400-DS, i11600-DS, i11800-DS\n * BIG-IP i11800\n * BIG-IP i15800\n\nBIG-IQ, F5 iWorkflow, Enterprise Manager, and Traffix\n\n * Virtual Edition/Virtual Platform\n\nIf you are running a version listed in the **Versions known to be vulnerable** column, you can eliminate this vulnerability by upgrading to a version listed in the **Fixes introduced in** column. If the table lists only an older version than what you are currently running, or does not list a non-vulnerable version, then no upgrade candidate currently exists.\n\nMitigation\n\nTo mitigate the vulnerability in multi-tenancy BIG-IP Virtual Clustered Multiprocessing (vCMP) configurations, ensure that all guests are set to at least two **Cores Per Guest**. Similarly, VE systems can be protected if the hypervisor ensures that potentially hostile co-guests cannot be scheduled on the same physical CPU.\n\n * [K41942608: Overview of Security Advisory articles](<https://support.f5.com/csp/article/K41942608>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n", "modified": "2019-09-24T18:21:00", "published": "2018-11-30T03:19:00", "id": "F5:K49711130", "href": "https://support.f5.com/csp/article/K49711130", "title": "OpenSSL and Intel processor SMT side-channel vulnerability (PortSmash) CVE-2018-5407", "type": "f5", "cvss": {"score": 1.9, "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"}}], "symantec": [{"lastseen": "2020-01-06T12:24:52", "bulletinFamily": "software", "description": "### Description\n\nOpenSSL is prone to an information-disclosure vulnerability. An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks. OpenSSL 1.0.2 through 1.0.2q are vulnerable.\n\n### Technologies Affected\n\n * Bluecoat BCAAA 6.1 \n * Bluecoat Mail Threat Defense 1.1 \n * IBM AIX 7.1 \n * IBM Aix 7.2 \n * IBM DataPower Gateway 2018.4.1.0 \n * IBM DataPower Gateway 2018.4.1.2 \n * IBM DataPower Gateway 2018.4.1.5 \n * IBM DataPower Gateway 2018.4.1.6 \n * IBM DataPower Gateway 2018.4.1.8 \n * IBM DataPower Gateway 7.6.0.0 \n * IBM DataPower Gateway 7.6.0.10 \n * IBM DataPower Gateway 7.6.0.11 \n * IBM DataPower Gateway 7.6.0.12 \n * IBM DataPower Gateway 7.6.0.14 \n * IBM DataPower Gateway 7.6.0.15 \n * IBM DataPower Gateway 7.6.0.17 \n * IBM DataPower Gateway 7.6.0.3 \n * IBM DataPower Gateway 7.6.0.8 \n * IBM DataPower Gateway 7.6.0.9 \n * IBM DataPower Gateways 7.6.0.0 \n * IBM DataPower Gateways 7.6.0.1 \n * IBM DataPower Gateways 7.6.0.5 \n * IBM DataPower Gateways 7.6.0.6 \n * IBM Vios 2.2.0 \n * OpenSSL Project OpenSSL 1.0.2 \n * OpenSSL Project OpenSSL 1.0.2a \n * OpenSSL Project OpenSSL 1.0.2b \n * OpenSSL Project OpenSSL 1.0.2c \n * OpenSSL Project OpenSSL 1.0.2d \n * OpenSSL Project OpenSSL 1.0.2e \n * OpenSSL Project OpenSSL 1.0.2f \n * OpenSSL Project OpenSSL 1.0.2g \n * OpenSSL Project OpenSSL 1.0.2h \n * OpenSSL Project OpenSSL 1.0.2i \n * OpenSSL Project OpenSSL 1.0.2j \n * OpenSSL Project OpenSSL 1.0.2k \n * OpenSSL Project OpenSSL 1.0.2l \n * OpenSSL Project OpenSSL 1.0.2m \n * OpenSSL Project OpenSSL 1.0.2n \n * OpenSSL Project OpenSSL 1.0.2o \n * OpenSSL Project OpenSSL 1.0.2p \n * OpenSSL Project OpenSSL 1.0.2q \n * Oracle Endeca Server 7.7.0 \n * Oracle Enterprise Manager Base Platform 12.1.0.5.0 \n * Oracle Enterprise Manager Base Platform 13.2.0.0.0 \n * Oracle Enterprise Manager Base Platform 13.3.0.0.0 \n * Oracle Enterprise Manager Ops Center 12.3.3 \n * Oracle Enterprise Manager Ops Center 12.4.0 \n * Oracle JD Edwards EnterpriseOne Tools 9.2 \n * Oracle JD Edwards World Security A9.3 \n * Oracle JD Edwards World Security A9.3.1 \n * Oracle JD Edwards World Security A9.4 \n * Oracle MySQL Connectors 5.3.10 \n * Oracle MySQL Connectors 5.3.12 \n * Oracle MySQL Connectors 5.3.7 \n * Oracle MySQL Connectors 5.3.9 \n * Oracle MySQL Connectors 8.0.11 \n * Oracle MySQL Connectors 8.0.12 \n * Oracle MySQL Connectors 8.0.13 \n * Oracle MySQL Connectors 8.0.15 \n * Oracle MySQL Server 5.6.15 \n * Oracle MySQL Server 5.6.16 \n * Oracle MySQL Server 5.6.20 \n * Oracle MySQL Server 5.6.21 \n * Oracle MySQL Server 5.6.22 \n * Oracle MySQL Server 5.6.23 \n * Oracle MySQL Server 5.6.24 \n * Oracle MySQL Server 5.6.25 \n * Oracle MySQL Server 5.6.26 \n * Oracle MySQL Server 5.6.27 \n * Oracle MySQL Server 5.6.28 \n * Oracle MySQL Server 5.6.29 \n * Oracle MySQL Server 5.6.30 \n * Oracle MySQL Server 5.6.33 \n * Oracle MySQL Server 5.6.34 \n * Oracle MySQL Server 5.6.35 \n * Oracle MySQL Server 5.6.36 \n * Oracle MySQL Server 5.6.37 \n * Oracle MySQL Server 5.6.38 \n * Oracle MySQL Server 5.6.39 \n * Oracle MySQL Server 5.6.40 \n * Oracle MySQL Server 5.6.41 \n * Oracle MySQL Server 5.6.42 \n * Oracle MySQL Server 5.6.43 \n * Oracle MySQL Server 5.7.0 \n * Oracle MySQL Server 5.7.12 \n * Oracle MySQL Server 5.7.15 \n * Oracle MySQL Server 5.7.16 \n * Oracle MySQL Server 5.7.17 \n * Oracle MySQL Server 5.7.18 \n * Oracle MySQL Server 5.7.19 \n * Oracle MySQL Server 5.7.20 \n * Oracle MySQL Server 5.7.21 \n * Oracle MySQL Server 5.7.22 \n * Oracle MySQL Server 5.7.23 \n * Oracle MySQL Server 5.7.24 \n * Oracle MySQL Server 5.7.25 \n * Oracle MySQL Server 8.0.11 \n * Oracle MySQL Server 8.0.12 \n * Oracle MySQL Server 8.0.13 \n * Oracle MySQL Server 8.0.14 \n * Oracle MySQL Server 8.0.15 \n * Oracle MySQL Workbench 6.1.4 \n * Oracle MySQL Workbench 6.1.5 \n * Oracle MySQL Workbench 6.3.10 \n * Oracle MySQL Workbench 6.3.8 \n * Oracle MySQL Workbench 8.0.11 \n * Oracle MySQL Workbench 8.0.13 \n * Oracle MySQL Workbench 8.0.16 \n * Oracle PeopleSoft Enterprise PeopleTools 8.55 \n * Oracle PeopleSoft Enterprise PeopleTools 8.56 \n * Oracle PeopleSoft Enterprise PeopleTools 8.57 \n * Oracle Secure Global Desktop 5.4 \n * Oracle Services Tools Bundle 19.2 \n * Oracle Solaris 10 \n * Oracle Solaris 11.3 \n * Oracle Solaris 11.4 \n * Symantec Content Analysis 2.3 \n * Symantec Content Analysis 2.4 \n * Symantec Malware Analysis 4.2 \n * Symantec Management Center 2.2 \n * Symantec Management Center 2.3 \n * Symantec PacketShaper 9.2 \n * Symantec PolicyCenter 9.2 \n * Symantec Reporter 10.3 \n * Symantec Reporter 10.4 \n * Symantec Security Analytics 7.2 \n * Symantec Security Analytics 7.3 \n * Symantec Security Analytics 8.0 \n\n### Recommendations\n\n**Block external access at the network boundary, unless external parties require service.** \nIf global access isn't needed, filter access to the affected computer at the network boundary. Restricting access to only trusted computers and networks might greatly reduce the likelihood of successful exploits.\n\n**Deploy network intrusion detection systems to monitor network traffic for malicious activity.** \nDeploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This includes but is not limited to requests that include NOP sleds and unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from successful exploits.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "modified": "2019-02-26T00:00:00", "published": "2019-02-26T00:00:00", "id": "SMNTC-107174", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/107174", "title": "OpenSSL CVE-2019-1559 Information Disclosure Vulnerability", "type": "symantec", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-10-16T14:35:02", "bulletinFamily": "software", "description": "### Description\n\nOpenSSL is prone to denial-of-service vulnerability. An attacker can exploit this issue to cause a denial-of-service condition.\n\n### Technologies Affected\n\n * OpenSSL Project OpenSSL 1.0.2 \n * OpenSSL Project OpenSSL 1.0.2a \n * OpenSSL Project OpenSSL 1.0.2b \n * OpenSSL Project OpenSSL 1.0.2c \n * OpenSSL Project OpenSSL 1.0.2d \n * OpenSSL Project OpenSSL 1.0.2e \n * OpenSSL Project OpenSSL 1.0.2f \n * OpenSSL Project OpenSSL 1.0.2g \n * OpenSSL Project OpenSSL 1.0.2h \n * OpenSSL Project OpenSSL 1.0.2i \n * OpenSSL Project OpenSSL 1.0.2j \n * OpenSSL Project OpenSSL 1.0.2k \n * OpenSSL Project OpenSSL 1.0.2l \n * OpenSSL Project OpenSSL 1.0.2m \n * OpenSSL Project OpenSSL 1.0.2n \n * OpenSSL Project OpenSSL 1.0.2o \n * OpenSSL Project OpenSSL 1.1.0 \n * OpenSSL Project OpenSSL 1.1.0a \n * OpenSSL Project OpenSSL 1.1.0b \n * OpenSSL Project OpenSSL 1.1.0c \n * OpenSSL Project OpenSSL 1.1.0d \n * OpenSSL Project OpenSSL 1.1.0e \n * OpenSSL Project OpenSSL 1.1.0f \n * OpenSSL Project OpenSSL 1.1.0g \n * OpenSSL Project OpenSSL 1.1.0h \n * Oracle API Gateway 11.1.2.4.0 \n * Oracle Agile Engineering Data Management 6.1.3 \n * Oracle Agile Engineering Data Management 6.2.0 \n * Oracle Agile Engineering Data Management 6.2.1 \n * Oracle Communications Application Session Controller 3.7.1 \n * Oracle Communications Application Session Controller 3.8.0 \n * Oracle Communications Diameter Signaling Router 8.0 \n * Oracle Communications Diameter Signaling Router 8.1 \n * Oracle Communications Diameter Signaling Router 8.2 \n * Oracle Communications Diameter Signaling Router 8.3 \n * Oracle Communications EAGLE LNP Application Processor 10.0 \n * Oracle Communications EAGLE LNP Application Processor 10.1 \n * Oracle Communications EAGLE LNP Application Processor 10.2 \n * Oracle Communications Operations Monitor 3.4 \n * Oracle Communications Operations Monitor 4.0 \n * Oracle Communications Session Border Controller SCZ7.4.0 \n * Oracle Communications Session Border Controller SCz7.4.1 \n * Oracle Communications Session Border Controller SCz8.0.0 \n * Oracle Communications Session Border Controller SCz8.1.0 \n * Oracle Communications Unified Session Manager 7.3.5 \n * Oracle Communications WebRTC Session Controller 7.0 \n * Oracle Communications WebRTC Session Controller 7.1 \n * Oracle Endeca Server 7.7.0 \n * Oracle Enterprise Communications Broker P-CZ2.1.0 \n * Oracle Enterprise Communications Broker P-CZ2.2.0 \n * Oracle Enterprise Communications Broker P-CZ3.0.0 \n * Oracle Enterprise Manager Base Platform 12.1.0.5 \n * Oracle Enterprise Manager Base Platform 13.2 \n * Oracle Enterprise Manager Base Platform 13.3 \n * Oracle Enterprise Manager Ops Center 12.2.2 \n * Oracle Enterprise Manager Ops Center 12.3.3 \n * Oracle Enterprise Session Border Controller E-CZ7.4.0 \n * Oracle Enterprise Session Border Controller E-CZ7.5.0 \n * Oracle Enterprise Session Border Controller E-CZ8.0.0 \n * Oracle Enterprise Session Border Controller E-CZ8.1.0 \n * Oracle Fujitsu M10-1 Server XCP 2230 \n * Oracle Fujitsu M10-1 Server XCP 2271 \n * Oracle Fujitsu M10-1 Server XCP 2280 \n * Oracle Fujitsu M10-1 Server XCP 2290 \n * Oracle Fujitsu M10-1 Server XCP 2320 \n * Oracle Fujitsu M10-1 Server XCP 2360 \n * Oracle Fujitsu M10-1 Server XCP 3050 \n * Oracle Fujitsu M10-1 Server XCP 3052 \n * Oracle Fujitsu M10-1 Server XCP 3053 \n * Oracle Fujitsu M10-1 Server XCP 3060 \n * Oracle Fujitsu M10-4 Server XCP 2230 \n * Oracle Fujitsu M10-4 Server XCP 2271 \n * Oracle Fujitsu M10-4 Server XCP 2280 \n * Oracle Fujitsu M10-4 Server XCP 2290 \n * Oracle Fujitsu M10-4 Server XCP 2320 \n * Oracle Fujitsu M10-4 Server XCP 2360 \n * Oracle Fujitsu M10-4 Server XCP 3050 \n * Oracle Fujitsu M10-4 Server XCP 3052 \n * Oracle Fujitsu M10-4 Server XCP 3053 \n * Oracle Fujitsu M10-4 Server XCP 3060 \n * Oracle Fujitsu M10-4S Server XCP 2230 \n * Oracle Fujitsu M10-4S Server XCP 2271 \n * Oracle Fujitsu M10-4S Server XCP 2280 \n * Oracle Fujitsu M10-4S Server XCP 2290 \n * Oracle Fujitsu M10-4S Server XCP 2320 \n * Oracle Fujitsu M10-4S Server XCP 2360 \n * Oracle Fujitsu M10-4S Server XCP 3050 \n * Oracle Fujitsu M10-4S Server XCP 3052 \n * Oracle Fujitsu M10-4S Server XCP 3053 \n * Oracle Fujitsu M10-4S Server XCP 3060 \n * Oracle Fujitsu M12-1 Server XCP 2230 \n * Oracle Fujitsu M12-1 Server XCP 2290 \n * Oracle Fujitsu M12-1 Server XCP 2320 \n * Oracle Fujitsu M12-1 Server XCP 2360 \n * Oracle Fujitsu M12-1 Server XCP 3000 \n * Oracle Fujitsu M12-1 Server XCP 3050 \n * Oracle Fujitsu M12-1 Server XCP 3052 \n * Oracle Fujitsu M12-1 Server XCP 3053 \n * Oracle Fujitsu M12-1 Server XCP 3060 \n * Oracle Fujitsu M12-2 Server XCP 2230 \n * Oracle Fujitsu M12-2 Server XCP 2290 \n * Oracle Fujitsu M12-2 Server XCP 2320 \n * Oracle Fujitsu M12-2 Server XCP 2360 \n * Oracle Fujitsu M12-2 Server XCP 3000 \n * Oracle Fujitsu M12-2 Server XCP 3050 \n * Oracle Fujitsu M12-2 Server XCP 3052 \n * Oracle Fujitsu M12-2 Server XCP 3053 \n * Oracle Fujitsu M12-2 Server XCP 3060 \n * Oracle Fujitsu M12-2S Server XCP 2230 \n * Oracle Fujitsu M12-2S Server XCP 2290 \n * Oracle Fujitsu M12-2S Server XCP 2320 \n * Oracle Fujitsu M12-2S Server XCP 2360 \n * Oracle Fujitsu M12-2S Server XCP 3000 \n * Oracle Fujitsu M12-2S Server XCP 3050 \n * Oracle Fujitsu M12-2S Server XCP 3052 \n * Oracle Fujitsu M12-2S Server XCP 3053 \n * Oracle Fujitsu M12-2S Server XCP 3060 \n * Oracle JD Edwards EnterpriseOne Tools 9.2 \n * Oracle JD Edwards World Security A9.3 \n * Oracle JD Edwards World Security A9.3.1 \n * Oracle JD Edwards World Security A9.4 \n * Oracle Linux 6.0 \n * Oracle Linux 7 \n * Oracle MySQL Enterprise Monitor 4.0.0.5135 \n * Oracle MySQL Enterprise Monitor 4.0.2.5168 \n * Oracle MySQL Enterprise Monitor 4.0.4.5235 \n * Oracle MySQL Enterprise Monitor 4.0.6.5281 \n * Oracle MySQL Enterprise Monitor 4.0.7 \n * Oracle MySQL Enterprise Monitor 8.0.0.8131 \n * Oracle MySQL Enterprise Monitor 8.0.13 \n * Oracle MySQL Enterprise Monitor 8.0.2.8191 \n * Oracle MySQL Workbench 6.1.4 \n * Oracle MySQL Workbench 6.1.5 \n * Oracle MySQL Workbench 6.3.10 \n * Oracle MySQL Workbench 6.3.8 \n * Oracle MySQL Workbench 8.0.11 \n * Oracle MySQL Workbench 8.0.13 \n * Oracle OSS Support Tools 18.2 \n * Oracle OSS Support Tools 18.3 \n * Oracle OSS Support Tools 18.4 \n * Oracle OSS Support Tools 19.0 \n * Oracle OSS Support Tools 2.11.0 \n * Oracle OSS Support Tools 2.11.33 \n * Oracle OSS Support Tools 8.15.17.3.14 \n * Oracle OSS Support Tools 8.8.15.7.15 \n * Oracle OSS Support Tools 8.9.15.9.8 \n * Oracle PeopleSoft Enterprise PeopleTools 8.55 \n * Oracle PeopleSoft Enterprise PeopleTools 8.56 \n * Oracle PeopleSoft Enterprise PeopleTools 8.57 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 15.1 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 15.2 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 16.1 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 16.2 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 17.12 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 17.7 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 18.8 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 8.4 \n * Oracle Tuxedo 12.1.1.0 \n * Paloaltonetworks PAN-OS 6.1.10 \n * Paloaltonetworks PAN-OS 6.1.11 \n * Paloaltonetworks PAN-OS 6.1.12 \n * Paloaltonetworks PAN-OS 6.1.13 \n * Paloaltonetworks PAN-OS 6.1.14 \n * Paloaltonetworks PAN-OS 6.1.15 \n * Paloaltonetworks PAN-OS 6.1.16 \n * Paloaltonetworks PAN-OS 6.1.17 \n * Paloaltonetworks PAN-OS 6.1.18 \n * Paloaltonetworks PAN-OS 6.1.19 \n * Paloaltonetworks PAN-OS 6.1.2 \n * Paloaltonetworks PAN-OS 6.1.20 \n * Paloaltonetworks PAN-OS 6.1.3 \n * Paloaltonetworks PAN-OS 6.1.4 \n * Paloaltonetworks PAN-OS 6.1.9 \n * Paloaltonetworks PAN-OS 7.1.0 \n * Paloaltonetworks PAN-OS 7.1.1 \n * Paloaltonetworks PAN-OS 7.1.10 \n * Paloaltonetworks PAN-OS 7.1.11 \n * Paloaltonetworks PAN-OS 7.1.12 \n * Paloaltonetworks PAN-OS 7.1.13 \n * Paloaltonetworks PAN-OS 7.1.14 \n * Paloaltonetworks PAN-OS 7.1.16 \n * Paloaltonetworks PAN-OS 7.1.17 \n * Paloaltonetworks PAN-OS 7.1.18 \n * Paloaltonetworks PAN-OS 7.1.19 \n * Paloaltonetworks PAN-OS 7.1.2 \n * Paloaltonetworks PAN-OS 7.1.3 \n * Paloaltonetworks PAN-OS 7.1.4 \n * Paloaltonetworks PAN-OS 7.1.5 \n * Paloaltonetworks PAN-OS 7.1.6 \n * Paloaltonetworks PAN-OS 7.1.7 \n * Paloaltonetworks PAN-OS 7.1.8 \n * Paloaltonetworks PAN-OS 7.1.9 \n * Paloaltonetworks PAN-OS 8.0.1 \n * Paloaltonetworks PAN-OS 8.0.10 \n * Paloaltonetworks PAN-OS 8.0.11 \n * Paloaltonetworks PAN-OS 8.0.12 \n * Paloaltonetworks PAN-OS 8.0.2 \n * Paloaltonetworks PAN-OS 8.0.3 \n * Paloaltonetworks PAN-OS 8.0.4 \n * Paloaltonetworks PAN-OS 8.0.5 \n * Paloaltonetworks PAN-OS 8.0.6 \n * Paloaltonetworks PAN-OS 8.0.7 \n * Paloaltonetworks PAN-OS 8.0.8 \n * Paloaltonetworks PAN-OS 8.0.9 \n * Paloaltonetworks PAN-OS 8.1.0 \n * Paloaltonetworks PAN-OS 8.1.1 \n * Paloaltonetworks PAN-OS 8.1.2 \n * Paloaltonetworks PAN-OS 8.1.3 \n * Paloaltonetworks WF-500 \n * Tenable Nessus 6.0.0 \n * Tenable Nessus 6.0.1 \n * Tenable Nessus 6.0.2 \n * Tenable Nessus 6.1.0 \n * Tenable Nessus 6.1.1 \n * Tenable Nessus 6.1.2 \n * Tenable Nessus 6.2.0 \n * Tenable Nessus 6.2.1 \n * Tenable Nessus 6.3.0 \n * Tenable Nessus 6.3.1 \n * Tenable Nessus 6.3.2 \n * Tenable Nessus 6.3.3 \n * Tenable Nessus 6.3.4 \n * Tenable Nessus 6.3.5 \n * Tenable Nessus 6.3.6 \n * Tenable Nessus 6.3.7 \n * Tenable Nessus 6.4.0 \n * Tenable Nessus 6.4.1 \n * Tenable Nessus 6.4.2 \n * Tenable Nessus 6.4.3 \n * Tenable Nessus 6.5.0 \n * Tenable Nessus 6.5.1 \n * Tenable Nessus 6.5.2 \n * Tenable Nessus 6.5.3 \n * Tenable Nessus 6.5.4 \n * Tenable Nessus 6.5.5 \n * Tenable Nessus 6.5.6 \n * Tenable Nessus 6.6.0 \n * Tenable Nessus 6.6.1 \n * Tenable Nessus 6.6.2 \n * Tenable Nessus 6.7.0 \n * Tenable Nessus 6.8.0 \n * Tenable Nessus 6.9.0 \n * Tenable Nessus 6.9.1 \n * Tenable Nessus 6.9.2 \n * Tenable Nessus 6.9.3 \n * Tenable Nessus 7.0 \n * Tenable Nessus 7.1.0 \n * Tenable Nessus 7.1.1 \n * Tenable Nessus 7.1.2 \n * Tenable Nessus 7.1.3 \n * Tenable Nessus 7.2.0 \n * Tenable Nessus 7.2.1 \n\n### Recommendations\n\n**Block external access at the network boundary, unless external parties require service.** \nIf global access isn't needed, filter access to the affected computer at the network boundary. Restricting access to only trusted computers and networks might greatly reduce the likelihood of successful exploits.\n\n**Deploy network intrusion detection systems to monitor network traffic for malicious activity.** \nDeploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This includes but is not limited to requests that include NOP sleds and unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from successful exploits.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "modified": "2018-06-12T00:00:00", "published": "2018-06-12T00:00:00", "id": "SMNTC-104442", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/104442", "title": "OpenSSL CVE-2018-0732 Denial of Service Vulnerability", "type": "symantec", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-06T12:24:53", "bulletinFamily": "software", "description": "### Description\n\nOpenSSL is prone to a local information-disclosure vulnerability. Local attackers can exploit this issue to obtain sensitive information. This may aid in further attacks.\n\n### Technologies Affected\n\n * Bluecoat BCAAA 6.1 \n * IBM AIX 5.3 \n * IBM AIX 6.1 \n * IBM AIX 7.1 \n * IBM Aix 7.2 \n * IBM DataPower Gateway 2018.4.1.0 \n * IBM DataPower Gateway 2018.4.1.2 \n * IBM DataPower Gateway 2018.4.1.5 \n * IBM DataPower Gateway 2018.4.1.6 \n * IBM DataPower Gateway 2018.4.1.8 \n * IBM DataPower Gateway 7.6.0.0 \n * IBM DataPower Gateway 7.6.0.10 \n * IBM DataPower Gateway 7.6.0.11 \n * IBM DataPower Gateway 7.6.0.12 \n * IBM DataPower Gateway 7.6.0.14 \n * IBM DataPower Gateway 7.6.0.15 \n * IBM DataPower Gateway 7.6.0.17 \n * IBM DataPower Gateway 7.6.0.3 \n * IBM DataPower Gateway 7.6.0.8 \n * IBM DataPower Gateway 7.6.0.9 \n * IBM DataPower Gateways 7.6.0.0 \n * IBM DataPower Gateways 7.6.0.1 \n * IBM DataPower Gateways 7.6.0.5 \n * IBM DataPower Gateways 7.6.0.6 \n * IBM DataPower Gateways 7.6.0.8 \n * IBM Vios 2.2.0 \n * IBM Vios 2.2.0.10 \n * IBM Vios 2.2.0.11 \n * IBM Vios 2.2.0.12 \n * IBM Vios 2.2.0.13 \n * IBM Vios 2.2.1.0 \n * IBM Vios 2.2.1.1 \n * IBM Vios 2.2.1.3 \n * IBM Vios 2.2.1.4 \n * IBM Vios 2.2.1.8 \n * IBM Vios 2.2.1.9 \n * IBM Vios 2.2.2.0 \n * IBM Vios 2.2.2.4 \n * IBM Vios 2.2.2.5 \n * IBM Vios 2.2.2.6 \n * IBM Vios 2.2.3 \n * IBM Vios 2.2.3.0 \n * IBM Vios 2.2.3.2 \n * IBM Vios 2.2.3.3 \n * IBM Vios 2.2.3.4 \n * IBM Vios 2.2.3.50 \n * IBM Vios 2.2.4.0 \n * OpenSSL Project OpenSSL 1.0.2 \n * OpenSSL Project OpenSSL 1.0.2 Beta1 \n * OpenSSL Project OpenSSL 1.0.2-1.0.2o \n * OpenSSL Project OpenSSL 1.0.2a \n * OpenSSL Project OpenSSL 1.0.2b \n * OpenSSL Project OpenSSL 1.0.2c \n * OpenSSL Project OpenSSL 1.0.2d \n * OpenSSL Project OpenSSL 1.0.2e \n * OpenSSL Project OpenSSL 1.0.2f \n * OpenSSL Project OpenSSL 1.0.2g \n * OpenSSL Project OpenSSL 1.0.2h \n * OpenSSL Project OpenSSL 1.0.2i \n * OpenSSL Project OpenSSL 1.0.2j \n * OpenSSL Project OpenSSL 1.0.2k \n * OpenSSL Project OpenSSL 1.0.2l \n * OpenSSL Project OpenSSL 1.0.2l-git \n * OpenSSL Project OpenSSL 1.0.2m \n * OpenSSL Project OpenSSL 1.0.2n \n * OpenSSL Project OpenSSL 1.0.2o \n * OpenSSL Project OpenSSL 1.0.2p \n * OpenSSL Project OpenSSL 1.0.2p-dev \n * OpenSSL Project OpenSSL 1.1.0 \n * OpenSSL Project OpenSSL 1.1.0a \n * OpenSSL Project OpenSSL 1.1.0b \n * OpenSSL Project OpenSSL 1.1.0c \n * OpenSSL Project OpenSSL 1.1.0d \n * OpenSSL Project OpenSSL 1.1.0e \n * OpenSSL Project OpenSSL 1.1.0f \n * OpenSSL Project OpenSSL 1.1.0g \n * OpenSSL Project OpenSSL 1.1.0h \n * OpenSSL Project OpenSSL 1.1.0i \n * OpenSSL Project OpenSSL 1.1.1 \n * Oracle API Gateway 11.1.2.4.0 \n * Oracle E-Business Suite 0.9.8 \n * Oracle E-Business Suite 1.0.0 \n * Oracle E-Business Suite 1.0.1 \n * Oracle Endeca Server 7.7.0 \n * Oracle Enterprise Manager Base Platform 12.1.0.5.0 \n * Oracle Enterprise Manager Base Platform 13.2.0.0.0 \n * Oracle Enterprise Manager Base Platform 13.3.0.0.0 \n * Oracle Enterprise Manager Ops Center 12.3.3 \n * Oracle MySQL Enterprise Backup 3.10.0 \n * Oracle MySQL Enterprise Backup 3.10.1 \n * Oracle MySQL Enterprise Backup 3.12.2 \n * Oracle MySQL Enterprise Backup 3.12.3 \n * Oracle MySQL Enterprise Backup 4.0.1 \n * Oracle MySQL Enterprise Backup 4.0.3 \n * Oracle MySQL Enterprise Backup 4.1.2 \n * Oracle MySQL Server 5.6.15 \n * Oracle MySQL Server 5.6.16 \n * Oracle MySQL Server 5.6.20 \n * Oracle MySQL Server 5.6.21 \n * Oracle MySQL Server 5.6.22 \n * Oracle MySQL Server 5.6.23 \n * Oracle MySQL Server 5.6.24 \n * Oracle MySQL Server 5.6.25 \n * Oracle MySQL Server 5.6.26 \n * Oracle MySQL Server 5.6.27 \n * Oracle MySQL Server 5.6.28 \n * Oracle MySQL Server 5.6.29 \n * Oracle MySQL Server 5.6.30 \n * Oracle MySQL Server 5.6.33 \n * Oracle MySQL Server 5.6.34 \n * Oracle MySQL Server 5.6.35 \n * Oracle MySQL Server 5.6.36 \n * Oracle MySQL Server 5.6.37 \n * Oracle MySQL Server 5.6.38 \n * Oracle MySQL Server 5.6.39 \n * Oracle MySQL Server 5.6.40 \n * Oracle MySQL Server 5.6.41 \n * Oracle MySQL Server 5.6.42 \n * Oracle MySQL Server 5.7.0 \n * Oracle MySQL Server 5.7.12 \n * Oracle MySQL Server 5.7.15 \n * Oracle MySQL Server 5.7.16 \n * Oracle MySQL Server 5.7.17 \n * Oracle MySQL Server 5.7.18 \n * Oracle MySQL Server 5.7.19 \n * Oracle MySQL Server 5.7.20 \n * Oracle MySQL Server 5.7.21 \n * Oracle MySQL Server 5.7.22 \n * Oracle MySQL Server 5.7.23 \n * Oracle MySQL Server 5.7.24 \n * Oracle MySQL Server 8.0.11 \n * Oracle MySQL Server 8.0.12 \n * Oracle MySQL Server 8.0.13 \n * Oracle PeopleSoft Enterprise PeopleTools 8.55 \n * Oracle PeopleSoft Enterprise PeopleTools 8.56 \n * Oracle PeopleSoft Enterprise PeopleTools 8.57 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 15.1 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 15.2 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 16.1 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 16.2 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 17.12 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 17.7 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 18.8 \n * Oracle Primavera P6 Enterprise Project Portfolio Management 8.4 \n * Oracle Solaris 10 \n * Oracle Solaris 11.3 \n * Oracle Solaris 11.4 \n * Oracle Tuxedo 12.1.1.0.0 \n * Oracle VM VirtualBox 1.6 \n * Oracle VM VirtualBox 1.6.0 \n * Oracle VM VirtualBox 1.6.2 \n * Oracle VM VirtualBox 1.6.4 \n * Oracle VM VirtualBox 1.6.6 \n * Oracle VM VirtualBox 2.0.0 \n * Oracle VM VirtualBox 2.0.10 \n * Oracle VM VirtualBox 2.0.12 \n * Oracle VM VirtualBox 2.0.2 \n * Oracle VM VirtualBox 2.0.4 \n * Oracle VM VirtualBox 2.0.6 \n * Oracle VM VirtualBox 2.0.8 \n * Oracle VM VirtualBox 2.1.0 \n * Oracle VM VirtualBox 2.1.2 \n * Oracle VM VirtualBox 2.1.4 \n * Oracle VM VirtualBox 2.2 \n * Oracle VM VirtualBox 2.2.0 \n * Oracle VM VirtualBox 2.2.2 \n * Oracle VM VirtualBox 2.2.4 \n * Oracle VM VirtualBox 3.0 \n * Oracle VM VirtualBox 3.0.0 \n * Oracle VM VirtualBox 3.0.10 \n * Oracle VM VirtualBox 3.0.12 \n * Oracle VM VirtualBox 3.0.14 \n * Oracle VM VirtualBox 3.0.2 \n * Oracle VM VirtualBox 3.0.4 \n * Oracle VM VirtualBox 3.0.6 \n * Oracle VM VirtualBox 3.0.8 \n * Oracle VM VirtualBox 3.1 \n * Oracle VM VirtualBox 3.1.0 \n * Oracle VM VirtualBox 3.1.2 \n * Oracle VM VirtualBox 3.1.4 \n * Oracle VM VirtualBox 3.1.6 \n * Oracle VM VirtualBox 3.1.8 \n * Oracle VM VirtualBox 3.2 \n * Oracle VM VirtualBox 3.2.0 \n * Oracle VM VirtualBox 3.2.10 \n * Oracle VM VirtualBox 3.2.12 \n * Oracle VM VirtualBox 3.2.14 \n * Oracle VM VirtualBox 3.2.16 \n * Oracle VM VirtualBox 3.2.18 \n * Oracle VM VirtualBox 3.2.19 \n * Oracle VM VirtualBox 3.2.2 \n * Oracle VM VirtualBox 3.2.20 \n * Oracle VM VirtualBox 3.2.21 \n * Oracle VM VirtualBox 3.2.22 \n * Oracle VM VirtualBox 3.2.24 \n * Oracle VM VirtualBox 3.2.25 \n * Oracle VM VirtualBox 3.2.4 \n * Oracle VM VirtualBox 3.2.6 \n * Oracle VM VirtualBox 3.2.8 \n * Oracle VM VirtualBox 3.3 \n * Oracle VM VirtualBox 4.0 \n * Oracle VM VirtualBox 4.0.0 \n * Oracle VM VirtualBox 4.0.10 \n * Oracle VM VirtualBox 4.0.12 \n * Oracle VM VirtualBox 4.0.14 \n * Oracle VM VirtualBox 4.0.16 \n * Oracle VM VirtualBox 4.0.18 \n * Oracle VM VirtualBox 4.0.2 \n * Oracle VM VirtualBox 4.0.20 \n * Oracle VM VirtualBox 4.0.21 \n * Oracle VM VirtualBox 4.0.22 \n * Oracle VM VirtualBox 4.0.23 \n * Oracle VM VirtualBox 4.0.24 \n * Oracle VM VirtualBox 4.0.26 \n * Oracle VM VirtualBox 4.0.27 \n * Oracle VM VirtualBox 4.0.30 \n * Oracle VM VirtualBox 4.0.34 \n * Oracle VM VirtualBox 4.0.35 \n * Oracle VM VirtualBox 4.0.36 \n * Oracle VM VirtualBox 4.0.4 \n * Oracle VM VirtualBox 4.0.6 \n * Oracle VM VirtualBox 4.0.8 \n * Oracle VM VirtualBox 4.1 \n * Oracle VM VirtualBox 4.1.0 \n * Oracle VM VirtualBox 4.1.10 \n * Oracle VM VirtualBox 4.1.14 \n * Oracle VM VirtualBox 4.1.16 \n * Oracle VM VirtualBox 4.1.18 \n * Oracle VM VirtualBox 4.1.2 \n * Oracle VM VirtualBox 4.1.20 \n * Oracle VM VirtualBox 4.1.22 \n * Oracle VM VirtualBox 4.1.24 \n * Oracle VM VirtualBox 4.1.26 \n * Oracle VM VirtualBox 4.1.28 \n * Oracle VM VirtualBox 4.1.29 \n * Oracle VM VirtualBox 4.1.30 \n * Oracle VM VirtualBox 4.1.31 \n * Oracle VM VirtualBox 4.1.32 \n * Oracle VM VirtualBox 4.1.34 \n * Oracle VM VirtualBox 4.1.35 \n * Oracle VM VirtualBox 4.1.38 \n * Oracle VM VirtualBox 4.1.4 \n * Oracle VM VirtualBox 4.1.42 \n * Oracle VM VirtualBox 4.1.43 \n * Oracle VM VirtualBox 4.1.44 \n * Oracle VM VirtualBox 4.1.6 \n * Oracle VM VirtualBox 4.1.8 \n * Oracle VM VirtualBox 4.2 \n * Oracle VM VirtualBox 4.2.0 \n * Oracle VM VirtualBox 4.2.10 \n * Oracle VM VirtualBox 4.2.12 \n * Oracle VM VirtualBox 4.2.14 \n * Oracle VM VirtualBox 4.2.16 \n * Oracle VM VirtualBox 4.2.18 \n * Oracle VM VirtualBox 4.2.19 \n * Oracle VM VirtualBox 4.2.2 \n * Oracle VM VirtualBox 4.2.20 \n * Oracle VM VirtualBox 4.2.22 \n * Oracle VM VirtualBox 4.2.23 \n * Oracle VM VirtualBox 4.2.24 \n * Oracle VM VirtualBox 4.2.26 \n * Oracle VM VirtualBox 4.2.27 \n * Oracle VM VirtualBox 4.2.30 \n * Oracle VM VirtualBox 4.2.34 \n * Oracle VM VirtualBox 4.2.35 \n * Oracle VM VirtualBox 4.2.36 \n * Oracle VM VirtualBox 4.2.4 \n * Oracle VM VirtualBox 4.2.6 \n * Oracle VM VirtualBox 4.2.8 \n * Oracle VM VirtualBox 4.3 \n * Oracle VM VirtualBox 4.3.0 \n * Oracle VM VirtualBox 4.3.10 \n * Oracle VM VirtualBox 4.3.12 \n * Oracle VM VirtualBox 4.3.14 \n * Oracle VM VirtualBox 4.3.15 \n * Oracle VM VirtualBox 4.3.16 \n * Oracle VM VirtualBox 4.3.17 \n * Oracle VM VirtualBox 4.3.18 \n * Oracle VM VirtualBox 4.3.19 \n * Oracle VM VirtualBox 4.3.2 \n * Oracle VM VirtualBox 4.3.20 \n * Oracle VM VirtualBox 4.3.26 \n * Oracle VM VirtualBox 4.3.32 \n * Oracle VM VirtualBox 4.3.33 \n * Oracle VM VirtualBox 4.3.34 \n * Oracle VM VirtualBox 4.3.35 \n * Oracle VM VirtualBox 4.3.36 \n * Oracle VM VirtualBox 4.3.4 \n * Oracle VM VirtualBox 4.3.5 \n * Oracle VM VirtualBox 4.3.6 \n * Oracle VM VirtualBox 4.3.7 \n * Oracle VM VirtualBox 4.3.8 \n * Oracle VM VirtualBox 4.3.9 \n * Oracle VM VirtualBox 5.0 \n * Oracle VM VirtualBox 5.0.10 \n * Oracle VM VirtualBox 5.0.11 \n * Oracle VM VirtualBox 5.0.12 \n * Oracle VM VirtualBox 5.0.13 \n * Oracle VM VirtualBox 5.0.14 \n * Oracle VM VirtualBox 5.0.16 \n * Oracle VM VirtualBox 5.0.18 \n * Oracle VM VirtualBox 5.0.22 \n * Oracle VM VirtualBox 5.0.26 \n * Oracle VM VirtualBox 5.0.28 \n * Oracle VM VirtualBox 5.0.32 \n * Oracle VM VirtualBox 5.0.34 \n * Oracle VM VirtualBox 5.0.38 \n * Oracle VM VirtualBox 5.0.8 \n * Oracle VM VirtualBox 5.0.9 \n * Oracle VM VirtualBox 5.1.10 \n * Oracle VM VirtualBox 5.1.14 \n * Oracle VM VirtualBox 5.1.16 \n * Oracle VM VirtualBox 5.1.20 \n * Oracle VM VirtualBox 5.1.24 \n * Oracle VM VirtualBox 5.1.30 \n * Oracle VM VirtualBox 5.1.32 \n * Oracle VM VirtualBox 5.1.36 \n * Oracle VM VirtualBox 5.1.8 \n * Oracle VM VirtualBox 5.2.0 \n * Oracle VM VirtualBox 5.2.10 \n * Oracle VM VirtualBox 5.2.16 \n * Oracle VM VirtualBox 5.2.18 \n * Oracle VM VirtualBox 5.2.2 \n * Oracle VM VirtualBox 5.2.20 \n * Oracle VM VirtualBox 5.2.22 \n * Oracle VM VirtualBox 5.2.4 \n * Oracle VM VirtualBox 5.2.6 \n * Symantec Director 6.1 \n * Symantec PacketShaper 9.2 \n * Symantec PolicyCenter 9.2 \n * Symantec Security Analytics 7.2 \n * Symantec Security Analytics 7.3 \n * Symantec Security Analytics 8.0 \n * Symantec Web Isolation 1.12 \n * Tenable Nessus 1.0.1 \n * Tenable Nessus 3.0.3 \n * Tenable Nessus 4.0 \n * Tenable Nessus 4.4.1 \n * Tenable Nessus 5.0.2.23205 \n * Tenable Nessus 5.2.3 \n * Tenable Nessus 5.2.4 \n * Tenable Nessus 5.2.7 \n * Tenable Nessus 6.0.0 \n * Tenable Nessus 6.0.1 \n * Tenable Nessus 6.0.2 \n * Tenable Nessus 6.1.0 \n * Tenable Nessus 6.1.1 \n * Tenable Nessus 6.1.2 \n * Tenable Nessus 6.2.0 \n * Tenable Nessus 6.2.1 \n * Tenable Nessus 6.3.0 \n * Tenable Nessus 6.3.1 \n * Tenable Nessus 6.3.2 \n * Tenable Nessus 6.3.3 \n * Tenable Nessus 6.3.4 \n * Tenable Nessus 6.3.5 \n * Tenable Nessus 6.3.6 \n * Tenable Nessus 6.3.7 \n * Tenable Nessus 6.4.0 \n * Tenable Nessus 6.4.1 \n * Tenable Nessus 6.4.2 \n * Tenable Nessus 6.4.3 \n * Tenable Nessus 6.5.0 \n * Tenable Nessus 6.5.1 \n * Tenable Nessus 6.5.2 \n * Tenable Nessus 6.5.3 \n * Tenable Nessus 6.5.4 \n * Tenable Nessus 6.5.5 \n * Tenable Nessus 6.5.6 \n * Tenable Nessus 6.6.0 \n * Tenable Nessus 6.6.1 \n * Tenable Nessus 6.6.2 \n * Tenable Nessus 6.7.0 \n * Tenable Nessus 6.8.0 \n * Tenable Nessus 6.9.0 \n * Tenable Nessus 6.9.1 \n * Tenable Nessus 6.9.2 \n * Tenable Nessus 6.9.3 \n * Tenable Nessus 7.0 \n * Tenable Nessus 7.1.0 \n * Tenable Nessus 7.1.1 \n * Tenable Nessus 7.1.2 \n * Tenable Nessus 7.1.3 \n * Tenable Nessus 7.2.0 \n * Tenable Nessus 7.2.1 \n * Tenable Nessus 7.2.2 \n * Tenable Nessus 8.0.0 \n * Tenable Nessus 8.1.0 \n\n### Recommendations\n\n**Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.** \nGiven the local nature of this issue, grant only trusted and accountable individuals access to affected computers.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "modified": "2018-10-30T00:00:00", "published": "2018-10-30T00:00:00", "id": "SMNTC-105758", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/105758", "title": "OpenSSL CVE-2018-0734 Side Channel Attack Information Disclosure Vulnerability", "type": "symantec", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "debian": [{"lastseen": "2020-02-09T02:35:12", "bulletinFamily": "unix", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4355-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nDecember 19, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : openssl1.0\nCVE ID : CVE-2018-0732 CVE-2018-0734 CVE-2018-0737 CVE-2018-5407\n\nSeveral local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1.0.2q-1~deb9u1. Going forward, openssl1.0 security updates for\nstretch will be based on the 1.0.2x upstream releases.\n\nWe recommend that you upgrade your openssl1.0 packages.\n\nFor the detailed security status of openssl1.0 please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/openssl1.0\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "modified": "2018-12-19T22:30:16", "published": "2018-12-19T22:30:16", "id": "DEBIAN:DSA-4355-1:1415E", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2018/msg00287.html", "title": "[SECURITY] [DSA 4355-1] openssl1.0 security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-02-09T02:29:59", "bulletinFamily": "unix", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4348-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nNovember 30, 2018 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : openssl\nCVE ID : CVE-2018-0732 CVE-2018-0734 CVE-2018-0735 CVE-2018-0737 \n CVE-2018-5407\n\nSeveral local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.\n\nFor the stable distribution (stretch), these problems have been fixed in\nversion 1.1.0j-1~deb9u1. Going forward, openssl security updates for\nstretch will be based on the 1.1.0x upstream releases.\n\nWe recommend that you upgrade your openssl packages.\n\nFor the detailed security status of openssl please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/openssl\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "modified": "2018-11-30T22:26:35", "published": "2018-11-30T22:26:35", "id": "DEBIAN:DSA-4348-1:05673", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2018/msg00280.html", "title": "[SECURITY] [DSA 4348-1] openssl security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-11-02T22:09:10", "bulletinFamily": "unix", "description": "Package : openssl\nVersion : 1.0.1t-1+deb8u9\nCVE ID : CVE-2018-0732 CVE-2018-0737\nDebian Bug : 895844\n\nTwo issues were discovered in OpenSSL, the Secure Sockets Layer toolkit.\n\nCVE-2018-0732\n\n Denial of service by a malicious server that sends a very large\n prime value to the client during TLS handshake.\n\nCVE-2018-0737\n\n Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and\n Luis Manuel Alvarez Tapia discovered that the OpenSSL RSA Key\n generation algorithm has been shown to be vulnerable to a cache\n timing side channel attack. An attacker with sufficient access to\n mount cache timing attacks during the RSA key generation process\n could recover the private key.\n\nFor Debian 8 &quot;Jessie&quot;, these problems have been fixed in version\n1.0.1t-1+deb8u9.\n\nWe recommend that you upgrade your openssl packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n", "modified": "2018-07-28T03:56:45", "published": "2018-07-28T03:56:45", "id": "DEBIAN:DLA-1449-1:EF247", "href": "https://lists.debian.org/debian-lts-announce/2018/debian-lts-announce-201807/msg00043.html", "title": "[SECURITY] [DLA 1449-1] openssl security update", "type": "debian", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "nessus": [{"lastseen": "2020-04-01T02:54:03", "bulletinFamily": "scanner", "description": "This update for openssl fixes the following issues :\n\nSecurity issues fixed :\n\nCVE-2018-0734: Fixed timing vulnerability in DSA signature generation\n(bsc#1113652).\n\nCVE-2018-5407: Fixed elliptic curve scalar multiplication timing\nattack defenses (bsc#1113534).\n\nCVE-2018-0737: Corrected the current error detection of the current\nfix (bsc#1106197).\n\nCVE-2016-8610: Adjusted current fix and add missing error string\n(bsc#1110018).\n\nAdd missing timing side channel patch for DSA signature generation\n(bsc#1113742).\n\nFixed the ", "modified": "2020-04-02T00:00:00", "id": "SUSE_SU-2018-3864-1.NASL", "href": "https://www.tenable.com/plugins/nessus/119116", "published": "2018-11-23T00:00:00", "title": "SUSE SLES12 Security Update : openssl (SUSE-SU-2018:3864-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:3864-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119116);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/09/10 13:51:49\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\");\n\n script_name(english:\"SUSE SLES12 Security Update : openssl (SUSE-SU-2018:3864-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openssl fixes the following issues :\n\nSecurity issues fixed :\n\nCVE-2018-0734: Fixed timing vulnerability in DSA signature generation\n(bsc#1113652).\n\nCVE-2018-5407: Fixed elliptic curve scalar multiplication timing\nattack defenses (bsc#1113534).\n\nCVE-2018-0737: Corrected the current error detection of the current\nfix (bsc#1106197).\n\nCVE-2016-8610: Adjusted current fix and add missing error string\n(bsc#1110018).\n\nAdd missing timing side channel patch for DSA signature generation\n(bsc#1113742).\n\nFixed the 'One and Done' side-channel attack on RSA (bsc#1104789).\n\nNon-security issues fixed: Added openssl(cli) so that the packages\nthat required the openssl binary can require this instead of the new\nopenssl meta package (bsc#1101470).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1101470\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1106197\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8610/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0737/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-5407/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20183864-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?2d8171cf\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP1-2018-2762=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl1_0_0-hmac\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/11/22\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/11/23\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libopenssl1_0_0-1.0.1i-54.20.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libopenssl1_0_0-debuginfo-1.0.1i-54.20.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libopenssl1_0_0-hmac-1.0.1i-54.20.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"openssl-1.0.1i-54.20.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"openssl-debuginfo-1.0.1i-54.20.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"openssl-debugsource-1.0.1i-54.20.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libopenssl1_0_0-32bit-1.0.1i-54.20.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libopenssl1_0_0-debuginfo-32bit-1.0.1i-54.20.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libopenssl1_0_0-hmac-32bit-1.0.1i-54.20.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openssl\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-03-28T07:09:28", "bulletinFamily": "scanner", "description": "Several local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.", "modified": "2018-12-20T00:00:00", "id": "DEBIAN_DSA-4355.NASL", "href": "https://www.tenable.com/plugins/nessus/119792", "published": "2018-12-20T00:00:00", "title": "Debian DSA-4355-1 : openssl1.0 - security update", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4355. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119792);\n script_version(\"1.3\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/03/27\");\n\n script_cve_id(\"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\");\n script_xref(name:\"DSA\", value:\"4355\");\n\n script_name(english:\"Debian DSA-4355-1 : openssl1.0 - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/openssl1.0\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/openssl1.0\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2018/dsa-4355\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the openssl1.0 packages.\n\nFor the stable distribution (stretch), these problems have been fixed\nin version 1.0.2q-1~deb9u1. Going forward, openssl1.0 security updates\nfor stretch will be based on the 1.0.2x upstream releases.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-0737\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:openssl1.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/12/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/12/20\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"libssl1.0-dev\", reference:\"1.0.2q-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libssl1.0.2\", reference:\"1.0.2q-1~deb9u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-04-01T07:06:39", "bulletinFamily": "scanner", "description": "Several local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.", "modified": "2020-04-02T00:00:00", "id": "DEBIAN_DSA-4348.NASL", "href": "https://www.tenable.com/plugins/nessus/119313", "published": "2018-12-01T00:00:00", "title": "Debian DSA-4348-1 : openssl - security update", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4348. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119313);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/04/05 23:25:05\");\n\n script_cve_id(\"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0735\", \"CVE-2018-0737\", \"CVE-2018-5407\");\n script_xref(name:\"DSA\", value:\"4348\");\n\n script_name(english:\"Debian DSA-4348-1 : openssl - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Several local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/openssl\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/openssl\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2018/dsa-4348\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the openssl packages.\n\nFor the stable distribution (stretch), these problems have been fixed\nin version 1.1.0j-1~deb9u1. Going forward, openssl security updates\nfor stretch will be based on the 1.1.0x upstream releases.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/11/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/12/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"9.0\", prefix:\"libcrypto1.1-udeb\", reference:\"1.1.0j-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libssl-dev\", reference:\"1.1.0j-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libssl-doc\", reference:\"1.1.0j-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libssl1.1\", reference:\"1.1.0j-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libssl1.1-udeb\", reference:\"1.1.0j-1~deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"openssl\", reference:\"1.1.0j-1~deb9u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-04-01T01:13:54", "bulletinFamily": "scanner", "description": "According to its self-reported version, the Tenable Nessus application\nrunning on the remote host is prior to 7.1.4. It is, therefore,\naffected by multiple vulnerabilities:\n\n - Tenable Nessus contains a flaw in the bundled third-party\n component OpenSSL library", "modified": "2020-04-02T00:00:00", "id": "NESSUS_TNS_2018_17.NASL", "href": "https://www.tenable.com/plugins/nessus/120198", "published": "2019-01-02T00:00:00", "title": "Tenable Nessus < 7.1.4 Multiple Vulnerabilities (TNS-2018-17)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(120198);\n script_version(\"1.3\");\n script_cvs_date(\"Date: 2019/10/31 15:18:51\");\n\n script_cve_id(\n \"CVE-2018-0732\",\n \"CVE-2018-0734\",\n \"CVE-2018-0737\",\n \"CVE-2018-5407\"\n );\n\n script_name(english:\"Tenable Nessus < 7.1.4 Multiple Vulnerabilities (TNS-2018-17)\");\n script_summary(english:\"Checks Tenable Nessus version.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"Tenable Nessus running on the remote host is affected by\nmultiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version, the Tenable Nessus application\nrunning on the remote host is prior to 7.1.4. It is, therefore,\naffected by multiple vulnerabilities:\n\n - Tenable Nessus contains a flaw in the bundled third-party\n component OpenSSL library's key handling during a TLS \n handshake that causes a denial of service vulnerability \n due to key handling during a TLS handshake. \n (CVE-2018-0732)\n\n - Tenable Nessus contains a flaw in the bundled third-party\n component OpenSSL library's DSA signature algorithm that\n renders it vulnerable to a timing side channel attack.\n An attacker could leverage this vulnerability to recover\n the private key. (CVE-2018-0734)\n\n - Tenable Nessus contains a flaw in the bundled third-party\n component OpenSSL library's RSA Key generation algorithm \n that allows a cache timing side channel attack to recover \n the private key. (CVE-2018-0737)\n\n - Tenable Nessus contains a flaw in the bundled third-party\n component OpenSSL library's Simultaneous Multithreading \n (SMT) architectures which render it vulnerable to \n side-channel leakage. This issue is known as 'PortSmash'. \n An attacker could possibly use this issue to perform a \n timing side-channel attack and recover private keys. \n (CVE-2018-5407)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.tenable.com/security/tns-2018-17\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Tenable Nessus version 7.1.4 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-0737\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/10/23\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/12/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/01/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:tenable:nessus\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"nessus_detect.nasl\");\n script_require_keys(\"installed_sw/nessus\");\n script_require_ports(\"Services/www\", 8834);\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"http.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"install_func.inc\");\n\ninclude(\"vcf.inc\");\n\nappname = \"nessus\";\nget_install_count(app_name:appname, exit_if_zero:TRUE);\nport = get_http_port(default:8834);\napp_info = vcf::get_app_info(app:appname, port:port, webapp:TRUE);\n\nvcf::check_granularity(app_info:app_info, sig_segments:3);\n\nconstraints = [\n { \"max_version\" : \"7.1.3\", \"fixed_version\" : \"7.1.4\" }\n];\n\nvcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-03-24T02:50:09", "bulletinFamily": "scanner", "description": "This update for openssl fixes the following issues :\n\nSecurity issues fixed :\n\nCVE-2018-0734: Fixed timing vulnerability in DSA signature generation\n(bsc#1113652).\n\nCVE-2018-5407: Fixed elliptic curve scalar multiplication timing\nattack defenses (bsc#1113534).\n\nCVE-2016-8610: Adjusted current fix and add missing error string\n(bsc#1110018).\n\nFixed the ", "modified": "2018-12-28T00:00:00", "id": "SUSE_SU-2018-4274-1.NASL", "href": "https://www.tenable.com/plugins/nessus/119937", "published": "2018-12-28T00:00:00", "title": "SUSE SLES11 Security Update : openssl (SUSE-SU-2018:4274-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:4274-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119937);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/03/23\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0734\", \"CVE-2018-5407\");\n\n script_name(english:\"SUSE SLES11 Security Update : openssl (SUSE-SU-2018:4274-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for openssl fixes the following issues :\n\nSecurity issues fixed :\n\nCVE-2018-0734: Fixed timing vulnerability in DSA signature generation\n(bsc#1113652).\n\nCVE-2018-5407: Fixed elliptic curve scalar multiplication timing\nattack defenses (bsc#1113534).\n\nCVE-2016-8610: Adjusted current fix and add missing error string\n(bsc#1110018).\n\nFixed the 'One and Done' side-channel attack on RSA (bsc#1104789).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8610/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-5407/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20184274-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?d3e8ebe5\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Studio Onsite 1.3:zypper in -t patch slestso13-openssl-13918=1\n\nSUSE Linux Enterprise Software Development Kit 11-SP4:zypper in -t\npatch sdksp4-openssl-13918=1\n\nSUSE Linux Enterprise Server 11-SP4:zypper in -t patch\nslessp4-openssl-13918=1\n\nSUSE Linux Enterprise Server 11-SP3-LTSS:zypper in -t patch\nslessp3-openssl-13918=1\n\nSUSE Linux Enterprise Point of Sale 11-SP3:zypper in -t patch\nsleposp3-openssl-13918=1\n\nSUSE Linux Enterprise Debuginfo 11-SP4:zypper in -t patch\ndbgsp4-openssl-13918=1\n\nSUSE Linux Enterprise Debuginfo 11-SP3:zypper in -t patch\ndbgsp3-openssl-13918=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-0734\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl0_9_8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl0_9_8-hmac\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:openssl-doc\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:11\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/12/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/12/28\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES11)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES11\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES11\" && (! preg(pattern:\"^(3|4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES11 SP3/4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-32bit-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-hmac-32bit-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"s390x\", reference:\"libopenssl0_9_8-32bit-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", cpu:\"s390x\", reference:\"libopenssl0_9_8-hmac-32bit-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"libopenssl0_9_8-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"libopenssl0_9_8-hmac-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"openssl-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"4\", reference:\"openssl-doc-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-32bit-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-hmac-32bit-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"s390x\", reference:\"libopenssl0_9_8-32bit-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", cpu:\"s390x\", reference:\"libopenssl0_9_8-hmac-32bit-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", reference:\"libopenssl-devel-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", reference:\"libopenssl0_9_8-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", reference:\"libopenssl0_9_8-hmac-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", reference:\"openssl-0.9.8j-0.106.18.1\")) flag++;\nif (rpm_check(release:\"SLES11\", sp:\"3\", reference:\"openssl-doc-0.9.8j-0.106.18.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"openssl\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-04-01T01:27:35", "bulletinFamily": "scanner", "description": "This update for compat-openssl098 fixes the following issues :\n\nSecurity issues fixed :\n\n - CVE-2018-0734: Fixed timing vulnerability in DSA\n signature generation (bsc#1113652).\n\n - CVE-2018-5407: Fixed elliptic curve scalar\n multiplication timing attack defenses (bsc#1113534).\n\n - CVE-2016-8610: Adjusted current fix and add missing\n error string (bsc#1110018).\n\n - Fixed the ", "modified": "2020-04-02T00:00:00", "id": "OPENSUSE-2018-1529.NASL", "href": "https://www.tenable.com/plugins/nessus/119641", "published": "2018-12-13T00:00:00", "title": "openSUSE Security Update : compat-openssl098 (openSUSE-2018-1529)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2018-1529.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119641);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/04/05 23:25:08\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0734\", \"CVE-2018-5407\");\n\n script_name(english:\"openSUSE Security Update : compat-openssl098 (openSUSE-2018-1529)\");\n script_summary(english:\"Check for the openSUSE-2018-1529 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for compat-openssl098 fixes the following issues :\n\nSecurity issues fixed :\n\n - CVE-2018-0734: Fixed timing vulnerability in DSA\n signature generation (bsc#1113652).\n\n - CVE-2018-5407: Fixed elliptic curve scalar\n multiplication timing attack defenses (bsc#1113534).\n\n - CVE-2016-8610: Adjusted current fix and add missing\n error string (bsc#1110018).\n\n - Fixed the 'One and Done' side-channel attack on RSA\n (bsc#1104789).\n\nThis update was imported from the SUSE:SLE-12:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected compat-openssl098 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:compat-openssl098-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenssl0_9_8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenssl0_9_8-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenssl0_9_8-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libopenssl0_9_8-debuginfo-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/12/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/12/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.3\", reference:\"compat-openssl098-debugsource-0.9.8j-27.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libopenssl0_9_8-0.9.8j-27.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libopenssl0_9_8-debuginfo-0.9.8j-27.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-32bit-0.9.8j-27.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-debuginfo-32bit-0.9.8j-27.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"compat-openssl098-debugsource / libopenssl0_9_8 / etc\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-04-01T02:54:11", "bulletinFamily": "scanner", "description": "This update for compat-openssl098 fixes the following issues :\n\nSecurity issues fixed :\n\nCVE-2018-0734: Fixed timing vulnerability in DSA signature generation\n(bsc#1113652).\n\nCVE-2018-5407: Fixed elliptic curve scalar multiplication timing\nattack defenses (bsc#1113534).\n\nCVE-2016-8610: Adjusted current fix and add missing error string\n(bsc#1110018).\n\nFixed the ", "modified": "2020-04-02T00:00:00", "id": "SUSE_SU-2018-4068-1.NASL", "href": "https://www.tenable.com/plugins/nessus/119646", "published": "2018-12-13T00:00:00", "title": "SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2018:4068-1)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2018:4068-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(119646);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/09/10 13:51:49\");\n\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0734\", \"CVE-2018-5407\");\n\n script_name(english:\"SUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2018:4068-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for compat-openssl098 fixes the following issues :\n\nSecurity issues fixed :\n\nCVE-2018-0734: Fixed timing vulnerability in DSA signature generation\n(bsc#1113652).\n\nCVE-2018-5407: Fixed elliptic curve scalar multiplication timing\nattack defenses (bsc#1113534).\n\nCVE-2016-8610: Adjusted current fix and add missing error string\n(bsc#1110018).\n\nFixed the 'One and Done' side-channel attack on RSA (bsc#1104789).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1104789\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1110018\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113534\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1113652\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2016-8610/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-0734/\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2018-5407/\"\n );\n # https://www.suse.com/support/update/announcement/2018/suse-su-20184068-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?82d30d7b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Server for SAP 12-SP4:zypper in -t patch\nSUSE-SLE-SAP-12-SP4-2018-2893=1\n\nSUSE Linux Enterprise Server for SAP 12-SP3:zypper in -t patch\nSUSE-SLE-SAP-12-SP3-2018-2893=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch\nSUSE-SLE-SAP-12-SP2-2018-2893=1\n\nSUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch\nSUSE-SLE-SAP-12-SP1-2018-2893=1\n\nSUSE Linux Enterprise Module for Legacy Software 12:zypper in -t patch\nSUSE-SLE-Module-Legacy-12-2018-2893=1\n\nSUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP4-2018-2893=1\n\nSUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP3-2018-2893=1\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:compat-openssl098-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl0_9_8\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libopenssl0_9_8-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/11/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/12/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/12/13\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12|SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12 / SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(3|4)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP3/4\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"compat-openssl098-debugsource-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl0_9_8-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl0_9_8-32bit-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl0_9_8-debuginfo-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libopenssl0_9_8-debuginfo-32bit-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"compat-openssl098-debugsource-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-32bit-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-debuginfo-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"4\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-debuginfo-32bit-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"compat-openssl098-debugsource-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-32bit-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-debuginfo-0.9.8j-106.9.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"3\", cpu:\"x86_64\", reference:\"libopenssl0_9_8-debuginfo-32bit-0.9.8j-106.9.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"compat-openssl098\");\n}\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-04-01T02:00:12", "bulletinFamily": "scanner", "description": "According to its banner, the version of OpenSSL running on the remote\nhost is 1.1.0 prior to 1.1.0i. It is, therefore, affected by a denial\nof service vulnerability, a cache timing side channel vulnerability,\nand a microarchitecture timing side channel attack.", "modified": "2020-04-02T00:00:00", "id": "OPENSSL_1_1_0I.NASL", "href": "https://www.tenable.com/plugins/nessus/112120", "published": "2018-08-27T00:00:00", "title": "OpenSSL 1.1.0 < 1.1.0i Multiple Vulnerabilities", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(112120);\n script_version(\"1.6\");\n script_cvs_date(\"Date: 2019/11/04\");\n\n script_cve_id(\"CVE-2018-0732\", \"CVE-2018-0737\", \"CVE-2018-5407\");\n script_bugtraq_id(103766, 104442);\n\n script_name(english:\"OpenSSL 1.1.0 < 1.1.0i Multiple Vulnerabilities\");\n script_summary(english:\"Performs a banner check.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"A service running on the remote host is affected by multiple\nvulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its banner, the version of OpenSSL running on the remote\nhost is 1.1.0 prior to 1.1.0i. It is, therefore, affected by a denial\nof service vulnerability, a cache timing side channel vulnerability,\nand a microarchitecture timing side channel attack.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.openssl.org/news/secadv/20180612.txt\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.openssl.org/news/secadv/20180416.txt\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.openssl.org/news/secadv/20181112.txt\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply the vendor patch or upgrade to OpenSSL version 1.1.0i or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2018-0737\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/08/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/08/27\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:openssl:openssl\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Web Servers\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"openssl_version.nasl\");\n script_require_keys(\"openssl/port\");\n\n exit(0);\n}\n\ninclude(\"openssl_version.inc\");\n\nopenssl_check_version(fixed:'1.1.0i', min:\"1.1.0\", severity:SECURITY_WARNING);\n\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2020-04-01T07:38:58", "bulletinFamily": "scanner", "description": "Patch for CVE-2018-0737, CVE-2018-0732, CVE-2018-0734, CVE-2019-1552,\nCVE-2019-1559.\n\nhttps://www.openssl.org/news/vulnerabilities.html\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "modified": "2020-04-02T00:00:00", "id": "FEDORA_2019-00C25B9379.NASL", "href": "https://www.tenable.com/plugins/nessus/129319", "published": "2019-09-25T00:00:00", "title": "Fedora 30 : 1:compat-openssl10 (2019-00c25b9379)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-00c25b9379.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(129319);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/12/24\");\n\n script_cve_id(\"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2019-1543\", \"CVE-2019-1552\", \"CVE-2019-1559\");\n script_xref(name:\"FEDORA\", value:\"2019-00c25b9379\");\n\n script_name(english:\"Fedora 30 : 1:compat-openssl10 (2019-00c25b9379)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Patch for CVE-2018-0737, CVE-2018-0732, CVE-2018-0734, CVE-2019-1552,\nCVE-2019-1559.\n\nhttps://www.openssl.org/news/vulnerabilities.html\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-00c25b9379\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.openssl.org/news/vulnerabilities.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected 1:compat-openssl10 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1543\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:1:compat-openssl10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:30\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^30([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 30\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC30\", reference:\"compat-openssl10-1.0.2o-7.fc30\", epoch:\"1\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"1:compat-openssl10\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2020-04-01T07:49:54", "bulletinFamily": "scanner", "description": "Patch for CVE-2018-0737, CVE-2018-0732, CVE-2018-0734, CVE-2019-1552,\nCVE-2019-1559.\n\nhttps://www.openssl.org/news/vulnerabilities.html\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "modified": "2020-04-02T00:00:00", "id": "FEDORA_2019-9A0A7C0986.NASL", "href": "https://www.tenable.com/plugins/nessus/129368", "published": "2019-09-26T00:00:00", "title": "Fedora 29 : 1:compat-openssl10 (2019-9a0a7c0986)", "type": "nessus", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-9a0a7c0986.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(129368);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/12/23\");\n\n script_cve_id(\"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2019-1543\", \"CVE-2019-1552\", \"CVE-2019-1559\");\n script_xref(name:\"FEDORA\", value:\"2019-9a0a7c0986\");\n\n script_name(english:\"Fedora 29 : 1:compat-openssl10 (2019-9a0a7c0986)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Patch for CVE-2018-0737, CVE-2018-0732, CVE-2018-0734, CVE-2019-1552,\nCVE-2019-1559.\n\nhttps://www.openssl.org/news/vulnerabilities.html\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-9a0a7c0986\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.openssl.org/news/vulnerabilities.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected 1:compat-openssl10 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-1543\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:1:compat-openssl10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:29\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2018/04/16\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/09/26\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/09/26\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^29([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 29\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC29\", reference:\"compat-openssl10-1.0.2o-7.fc29\", epoch:\"1\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"1:compat-openssl10\");\n}\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}], "openvas": [{"lastseen": "2019-07-04T18:56:07", "bulletinFamily": "scanner", "description": "Several local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.", "modified": "2019-07-04T00:00:00", "published": "2018-11-30T00:00:00", "id": "OPENVAS:1361412562310704348", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704348", "title": "Debian Security Advisory DSA 4348-1 (openssl - security update)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Auto-generated from advisory DSA 4348-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704348\");\n script_version(\"2019-07-04T09:25:28+0000\");\n script_cve_id(\"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0735\", \"CVE-2018-0737\", \"CVE-2018-5407\");\n script_name(\"Debian Security Advisory DSA 4348-1 (openssl - security update)\");\n script_tag(name:\"last_modification\", value:\"2019-07-04 09:25:28 +0000 (Thu, 04 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-11-30 00:00:00 +0100 (Fri, 30 Nov 2018)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2018/dsa-4348.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n script_tag(name:\"affected\", value:\"openssl on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (stretch), these problems have been fixed in\nversion 1.1.0j-1~deb9u1. Going forward, openssl security updates for\nstretch will be based on the 1.1.0x upstream releases.\n\nWe recommend that you upgrade your openssl packages.\");\n\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/openssl\");\n script_tag(name:\"summary\", value:\"Several local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"libssl-dev\", ver:\"1.1.0j-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libssl1.1\", ver:\"1.1.0j-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"openssl\", ver:\"1.1.0j-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:32:04", "bulletinFamily": "scanner", "description": "This host is running Nessus and is prone to\n multiple vulnerabilities.", "modified": "2019-05-03T00:00:00", "published": "2019-01-09T00:00:00", "id": "OPENVAS:1361412562310107444", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310107444", "title": "Tenable Nessus < 7.1.4 Multiple Vulnerabilities(tns-2018-17)", "type": "openvas", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nCPE = \"cpe:/a:tenable:nessus\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.107444\");\n script_version(\"2019-05-03T08:55:39+0000\");\n script_cve_id(\"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2019-05-03 08:55:39 +0000 (Fri, 03 May 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-01-09 12:29:11 +0100 (Wed, 09 Jan 2019)\");\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_name(\"Tenable Nessus < 7.1.4 Multiple Vulnerabilities(tns-2018-17)\");\n\n script_tag(name:\"summary\", value:\"This host is running Nessus and is prone to\n multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Tenable Nessus is affected by multiple vulnerabilities:\n\n - Tenable Nessus contains a flaw in the bundled third-party component OpenSSL library's key handling during a TLS handshake that causes a denial of service vulnerability due to key handling during a TLS handshake. (CVE-2018-0732)\n\n - Tenable Nessus contains a flaw in the bundled third-party component OpenSSL library's DSA signature algorithm that renders it vulnerable to a timing side channel attack.\nAn attacker could leverage this vulnerability to recover the private key. (CVE-2018-0734)\n\n - Tenable Nessus contains a flaw in the bundled third-party component OpenSSL library's RSA Key generation algorithm that allows a cache timing side channel attack to recover the private key. (CVE-2018-0737)\n\n - Tenable Nessus contains a flaw in the bundled third-party component OpenSSL library's Simultaneous Multithreading (SMT) architectures which render it vulnerable to side-channel leakage. This issue is known as 'PortSmash'. An attacker could possibly use this issue to perform a timing side-channel attack and recover private keys. (CVE-2018-5407)\");\n\n script_tag(name:\"impact\", value:\"An attacker could leverage this vulnerability to recover the private key and could possibly use this issue to perform a timing side-channel attack and recover private keys.\");\n\n script_tag(name:\"affected\", value:\"Nessus versions prior to version 7.1.4.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to nessus version 7.1.4 or later. Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name:\"URL\", value:\"https://www.tenable.com\");\n script_xref(name:\"URL\", value:\"https://www.tenable.com/security/tns-2018-17\");\n\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_category(ACT_GATHER_INFO);\n script_family(\"Web application abuses\");\n script_dependencies(\"gb_nessus_web_server_detect.nasl\");\n script_mandatory_keys(\"nessus/installed\");\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!nesPort = get_app_port(cpe:CPE)){\n exit(0);\n}\n\nif(!infos = get_app_version_and_location(cpe:CPE, port:nesPort, exit_no_version:TRUE)) exit(0);\n\nnesVer = infos['version'];\npath = infos['location'];\n\nif(version_is_less(version:nesVer, test_version:\"7.1.4\"))\n{\n report = report_fixed_ver(installed_version:nesVer, fixed_version:\"7.1.4\", install_path:path);\n security_message(data:report, port:nesPort);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-07-04T18:56:36", "bulletinFamily": "scanner", "description": "Several local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.", "modified": "2019-07-04T00:00:00", "published": "2018-12-19T00:00:00", "id": "OPENVAS:1361412562310704355", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704355", "title": "Debian Security Advisory DSA 4355-1 (openssl1.0 - security update)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Auto-generated from advisory DSA 4355-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License as published by\n# the Free Software Foundation; either version 2 of the License, or\n# (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704355\");\n script_version(\"2019-07-04T09:25:28+0000\");\n script_cve_id(\"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2018-0737\", \"CVE-2018-5407\");\n script_name(\"Debian Security Advisory DSA 4355-1 (openssl1.0 - security update)\");\n script_tag(name:\"last_modification\", value:\"2019-07-04 09:25:28 +0000 (Thu, 04 Jul 2019)\");\n script_tag(name:\"creation_date\", value:\"2018-12-19 00:00:00 +0100 (Wed, 19 Dec 2018)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2018/dsa-4355.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB9\");\n script_tag(name:\"affected\", value:\"openssl1.0 on Debian Linux\");\n script_tag(name:\"solution\", value:\"For the stable distribution (stretch), these problems have been fixed in\nversion 1.0.2q-1~deb9u1. Going forward, openssl1.0 security updates for\nstretch will be based on the 1.0.2x upstream releases.\n\nWe recommend that you upgrade your openssl1.0 packages.\");\n\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/openssl1.0\");\n script_tag(name:\"summary\", value:\"Several local side channel attacks and a denial of service via large\nDiffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets\nLayer toolkit.\");\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"libcrypto1.0.2-udeb\", ver:\"1.0.2q-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libssl1.0-dev\", ver:\"1.0.2q-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libssl1.0.2\", ver:\"1.0.2q-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libssl1.0.2-udeb\", ver:\"1.0.2q-1~deb9u1\", rls:\"DEB9\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-01-31T17:35:36", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2018-12-13T00:00:00", "id": "OPENVAS:1361412562310852178", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852178", "title": "openSUSE: Security Advisory for compat-openssl098 (openSUSE-SU-2018:4104-1)", "type": "openvas", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852178\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_cve_id(\"CVE-2016-8610\", \"CVE-2018-0734\", \"CVE-2018-5407\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-12-13 07:30:48 +0100 (Thu, 13 Dec 2018)\");\n script_name(\"openSUSE: Security Advisory for compat-openssl098 (openSUSE-SU-2018:4104-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.3\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2018:4104-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2018-12/msg00026.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'compat-openssl098'\n package(s) announced via the openSUSE-SU-2018:4104-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for compat-openssl098 fixes\n the following issues:\n\n Security issues fixed:\n\n - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation\n (bsc#1113652).\n\n - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack\n defenses (bsc#1113534).\n\n - CVE-2016-8610: Adjusted current fix and add missing error string\n (bsc#1110018).\n\n - Fixed the 'One and Done' side-channel attack on RSA (bsc#1104789).\n\n This update was imported from the SUSE:SLE-12:Update update project.\n\n Patch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended\n installation methods\n like YaST online_update or 'zypper patch'.\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 42.3:\n\n zypper in -t patch openSUSE-2018-1529=1\");\n\n script_tag(name:\"affected\", value:\"compat-openssl098 on openSUSE Leap 42.3.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.3\") {\n if(!isnull(res = isrpmvuln(pkg:\"compat-openssl098-debugsource\", rpm:\"compat-openssl098-debugsource~0.9.8j~27.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libopenssl0_9_8\", rpm:\"libopenssl0_9_8~0.9.8j~27.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libopenssl0_9_8-debuginfo\", rpm:\"libopenssl0_9_8-debuginfo~0.9.8j~27.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libopenssl0_9_8-32bit\", rpm:\"libopenssl0_9_8-32bit~0.9.8j~27.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libopenssl0_9_8-debuginfo-32bit\", rpm:\"libopenssl0_9_8-debuginfo-32bit~0.9.8j~27.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:32:04", "bulletinFamily": "scanner", "description": "This host is running OpenSSL and is prone\n to a padding oracle attack.", "modified": "2019-03-06T00:00:00", "published": "2019-02-27T00:00:00", "id": "OPENVAS:1361412562310108555", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310108555", "title": "OpenSSL: 0-byte record padding oracle (CVE-2019-1559) (Windows)", "type": "openvas", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nCPE = \"cpe:/a:openssl:openssl\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.108555\");\n script_version(\"$Revision: 14008 $\");\n script_cve_id(\"CVE-2019-1559\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-06 08:38:19 +0100 (Wed, 06 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2019-02-27 07:48:22 +0100 (Wed, 27 Feb 2019)\");\n script_name(\"OpenSSL: 0-byte record padding oracle (CVE-2019-1559) (Windows)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_openssl_detect.nasl\", \"gb_openssl_detect_win.nasl\", \"os_detection.nasl\");\n script_mandatory_keys(\"openssl/detected\", \"Host/runs_windows\");\n\n script_xref(name:\"URL\", value:\"https://www.openssl.org/news/secadv/20190226.txt\");\n script_xref(name:\"URL\", value:\"https://github.com/RUB-NDS/TLS-Padding-Oracles#openssl-cve-2019-1559\");\n\n script_tag(name:\"summary\", value:\"This host is running OpenSSL and is prone\n to a padding oracle attack.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"If an application encounters a fatal protocol error and then calls\n SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond\n differently to the calling application if a 0 byte record is received with invalid padding compared\n to if a 0 byte record is received with an invalid MAC.\");\n\n script_tag(name:\"impact\", value:\"If the application then behaves differently based on that in a way that\n is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data.\n\n In order for this to be exploitable 'non-stitched' ciphersuites must be in use. Stitched ciphersuites\n are optimised implementations of certain commonly used ciphersuites. Also the application must call\n SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some\n do anyway). AEAD ciphersuites are not impacted.\");\n\n script_tag(name:\"affected\", value:\"OpenSSL versions 1.0.2-1.0.2q.\n\n This issue does not impact OpenSSL 1.1.1 or 1.1.0.\");\n\n script_tag(name:\"solution\", value:\"Upgrade OpenSSL to version 1.0.2r or later. See the references for more details.\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( isnull( port = get_app_port( cpe:CPE ) ) )\n exit( 0 );\n\nif( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )\n exit( 0 );\n\nvers = infos['version'];\npath = infos['location'];\n\nif( version_in_range( version:vers, test_version:\"1.0.2\", test_version2:\"1.0.2q\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"1.0.2r\", install_path:path );\n security_message( port:port, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-05-29T18:32:04", "bulletinFamily": "scanner", "description": "This host is running OpenSSL and is prone\n to a padding oracle attack.", "modified": "2019-03-06T00:00:00", "published": "2019-02-27T00:00:00", "id": "OPENVAS:1361412562310108556", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310108556", "title": "OpenSSL: 0-byte record padding oracle (CVE-2019-1559) (Linux)", "type": "openvas", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nCPE = \"cpe:/a:openssl:openssl\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.108556\");\n script_version(\"$Revision: 14008 $\");\n script_cve_id(\"CVE-2019-1559\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-06 08:38:19 +0100 (Wed, 06 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2019-02-27 07:48:22 +0100 (Wed, 27 Feb 2019)\");\n script_name(\"OpenSSL: 0-byte record padding oracle (CVE-2019-1559) (Linux)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_openssl_detect.nasl\", \"gb_openssl_detect_lin.nasl\", \"os_detection.nasl\");\n script_mandatory_keys(\"openssl/detected\", \"Host/runs_unixoide\");\n\n script_xref(name:\"URL\", value:\"https://www.openssl.org/news/secadv/20190226.txt\");\n script_xref(name:\"URL\", value:\"https://github.com/RUB-NDS/TLS-Padding-Oracles#openssl-cve-2019-1559\");\n\n script_tag(name:\"summary\", value:\"This host is running OpenSSL and is prone\n to a padding oracle attack.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"If an application encounters a fatal protocol error and then calls\n SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond\n differently to the calling application if a 0 byte record is received with invalid padding compared\n to if a 0 byte record is received with an invalid MAC.\");\n\n script_tag(name:\"impact\", value:\"If the application then behaves differently based on that in a way that\n is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data.\n\n In order for this to be exploitable 'non-stitched' ciphersuites must be in use. Stitched ciphersuites\n are optimised implementations of certain commonly used ciphersuites. Also the application must call\n SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some\n do anyway). AEAD ciphersuites are not impacted.\");\n\n script_tag(name:\"affected\", value:\"OpenSSL versions 1.0.2-1.0.2q.\n\n This issue does not impact OpenSSL 1.1.1 or 1.1.0.\");\n\n script_tag(name:\"solution\", value:\"Upgrade OpenSSL to version 1.0.2r or later. See the references for more details.\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner_unreliable\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( isnull( port = get_app_port( cpe:CPE ) ) )\n exit( 0 );\n\nif( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )\n exit( 0 );\n\nvers = infos['version'];\npath = infos['location'];\n\nif( version_in_range( version:vers, test_version:\"1.0.2\", test_version2:\"1.0.2q\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"1.0.2r\", install_path:path );\n security_message( port:port, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-09-27T12:39:20", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-09-27T00:00:00", "published": "2019-09-26T00:00:00", "id": "OPENVAS:1361412562310876846", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310876846", "title": "Fedora Update for compat-openssl10 FEDORA-2019-9a0a7c0986", "type": "openvas", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.876846\");\n script_version(\"2019-09-27T07:41:55+0000\");\n script_cve_id(\"CVE-2018-0737\", \"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2019-1552\", \"CVE-2019-1559\", \"CVE-2019-1543\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2019-09-27 07:41:55 +0000 (Fri, 27 Sep 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-09-26 02:32:32 +0000 (Thu, 26 Sep 2019)\");\n script_name(\"Fedora Update for compat-openssl10 FEDORA-2019-9a0a7c0986\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC29\");\n\n script_xref(name:\"FEDORA\", value:\"2019-9a0a7c0986\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'compat-openssl10'\n package(s) announced via the FEDORA-2019-9a0a7c0986 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The OpenSSL toolkit provides support for secure communications between\nmachines. This version of OpenSSL package contains only the libraries\nand is provided for compatibility with previous releases and software\nthat does not support compilation with OpenSSL-1.1.\");\n\n script_tag(name:\"affected\", value:\"'compat-openssl10' package(s) on Fedora 29.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC29\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"compat-openssl10\", rpm:\"compat-openssl10~1.0.2o~7.fc29\", rls:\"FC29\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-09-27T12:37:26", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2019-09-27T00:00:00", "published": "2019-09-26T00:00:00", "id": "OPENVAS:1361412562310876840", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310876840", "title": "Fedora Update for compat-openssl10 FEDORA-2019-00c25b9379", "type": "openvas", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.876840\");\n script_version(\"2019-09-27T07:41:55+0000\");\n script_cve_id(\"CVE-2018-0737\", \"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2019-1552\", \"CVE-2019-1559\", \"CVE-2019-1543\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2019-09-27 07:41:55 +0000 (Fri, 27 Sep 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-09-26 02:31:22 +0000 (Thu, 26 Sep 2019)\");\n script_name(\"Fedora Update for compat-openssl10 FEDORA-2019-00c25b9379\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC30\");\n\n script_xref(name:\"FEDORA\", value:\"2019-00c25b9379\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'compat-openssl10'\n package(s) announced via the FEDORA-2019-00c25b9379 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The OpenSSL toolkit provides support for secure communications between\nmachines. This version of OpenSSL package contains only the libraries\nand is provided for compatibility with previous releases and software\nthat does not support compilation with OpenSSL-1.1.\");\n\n script_tag(name:\"affected\", value:\"'compat-openssl10' package(s) on Fedora 30.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC30\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"compat-openssl10\", rpm:\"compat-openssl10~1.0.2o~7.fc30\", rls:\"FC30\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2020-01-14T14:48:53", "bulletinFamily": "scanner", "description": "The remote host is missing an update for the ", "modified": "2020-01-13T00:00:00", "published": "2020-01-09T00:00:00", "id": "OPENVAS:1361412562310877283", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310877283", "title": "Fedora Update for compat-openssl10 FEDORA-2019-db06efdea1", "type": "openvas", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.877283\");\n script_version(\"2020-01-13T11:49:13+0000\");\n script_cve_id(\"CVE-2018-0737\", \"CVE-2018-0732\", \"CVE-2018-0734\", \"CVE-2019-1552\", \"CVE-2019-1559\", \"CVE-2019-1543\");\n script_tag(name:\"cvss_base\", value:\"5.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-01-13 11:49:13 +0000 (Mon, 13 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-09 07:35:57 +0000 (Thu, 09 Jan 2020)\");\n script_name(\"Fedora Update for compat-openssl10 FEDORA-2019-db06efdea1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC31\");\n\n script_xref(name:\"FEDORA\", value:\"2019-db06efdea1\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'compat-openssl10'\n package(s) announced via the FEDORA-2019-db06efdea1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"The OpenSSL toolkit provides support for secure communications between\nmachines. This version of OpenSSL package contains only the libraries\nand is provided for compatibility with previous releases and software\nthat does not support compilation with OpenSSL-1.1.\");\n\n script_tag(name:\"affected\", value:\"'compat-openssl10' package(s) on Fedora 31.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC31\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"compat-openssl10\", rpm:\"compat-openssl10~1.0.2o~8.fc31\", rls:\"FC31\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 5.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:32:34", "bulletinFamily": "scanner", "description": "This host is running OpenSSL and is prone\n to an information disclosure vulnerability.", "modified": "2019-02-27T00:00:00", "published": "2018-11-22T00:00:00", "id": "OPENVAS:1361412562310108484", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310108484", "title": "OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) (Windows)", "type": "openvas", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_openssl_secadv_20181112_win.nasl 13898 2019-02-27 08:37:43Z cfischer $\n#\n# OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) (Windows)\n#\n# Authors:\n# Christian Fischer <christian.fischer@greenbone.net>\n#\n# Copyright:\n# Copyright (C) 2018 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nCPE = \"cpe:/a:openssl:openssl\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.108484\");\n script_version(\"$Revision: 13898 $\");\n script_cve_id(\"CVE-2018-5407\");\n script_bugtraq_id(105897);\n script_tag(name:\"cvss_base\", value:\"1.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:M/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-02-27 09:37:43 +0100 (Wed, 27 Feb 2019) $\");\n script_tag(name:\"creation_date\", value:\"2018-11-22 07:48:19 +0100 (Thu, 22 Nov 2018)\");\n script_name(\"OpenSSL: Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) (Windows)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_openssl_detect.nasl\", \"gb_openssl_detect_win.nasl\", \"os_detection.nasl\");\n script_mandatory_keys(\"openssl/detected\", \"Host/runs_windows\");\n\n script_xref(name:\"URL\", value:\"https://www.openssl.org/news/secadv/20181112.txt\");\n script_xref(name:\"URL\", value:\"https://www.openssl.org/news/vulnerabilities.html\");\n script_xref(name:\"URL\", value:\"https://github.com/openssl/openssl/commit/aab7c770353b1dc4ba045938c8fb446dd1c4531e\");\n script_xref(name:\"URL\", value:\"https://github.com/openssl/openssl/commit/b18162a7c9bbfb57112459a4d6631fa258fd8c0cq\");\n script_xref(name:\"URL\", value:\"http://www.securityfocus.com/bid/105897\");\n script_xref(name:\"URL\", value:\"https://eprint.iacr.org/2018/1060.pdf\");\n script_xref(name:\"URL\", value:\"https://github.com/bbbrumley/portsmash\");\n script_xref(name:\"URL\", value:\"https://www.exploit-db.com/exploits/45785/\");\n\n script_tag(name:\"summary\", value:\"This host is running OpenSSL and is prone\n to an information disclosure vulnerability.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH,\n has been shown to be vulnerable to a microarchitecture timing side channel attack.\");\n\n script_tag(name:\"impact\", value:\"An attacker with sufficient access to mount local timing attacks\n during ECDSA signature generation could recover the private key.\");\n\n script_tag(name:\"affected\", value:\"OpenSSL versions 1.1.0-1.1.0h and 1.0.2-1.0.2p.\");\n\n script_tag(name:\"solution\", value:\"Upgrade OpenSSL to version 1.0.2q, 1.1.0i or later. See the references for more details.\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\n\nif( isnull( port = get_app_port( cpe:CPE ) ) )\n exit( 0 );\n\nif( ! infos = get_app_version_and_location( cpe:CPE, port:port, exit_no_version:TRUE ) )\n exit( 0 );\n\nvers = infos['version'];\npath = infos['location'];\n\nif( version_in_range( version:vers, test_version:\"1.1.0\", test_version2:\"1.1.0h\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"1.1.0i\", install_path:path );\n security_message( port:port, data:report );\n exit( 0 );\n}\n\nif( version_in_range( version:vers, test_version:\"1.0.2\", test_version2:\"1.0.2p\" ) ) {\n report = report_fixed_ver( installed_version:vers, fixed_version:\"1.0.2q\", install_path:path );\n security_message( port:port, data:report );\n exit( 0 );\n}\n\nexit( 99 );", "cvss": {"score": 1.9, "vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"}}], "suse": [{"lastseen": "2018-12-13T05:36:33", "bulletinFamily": "unix", "description": "This update for compat-openssl098 fixes the following issues:\n\n Security issues fixed:\n\n - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation\n (bsc#1113652).\n - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack\n defenses (bsc#1113534).\n - CVE-2016-8610: Adjusted current fix and add missing error string\n (bsc#1110018).\n - Fixed the &quot;One and Done&quot; side-channel attack on RSA (bsc#1104789).\n\n This update was imported from the SUSE:SLE-12:Update update project.\n\n", "modified": "2018-12-13T03:13:21", "published": "2018-12-13T03:13:21", "id": "OPENSUSE-SU-2018:4104-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-12/msg00026.html", "title": "Security update for compat-openssl098 (moderate)", "type": "suse", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-10-05T14:29:18", "bulletinFamily": "unix", "description": "This update for openssl-1_0_0 to 1.0.2p fixes the following issues:\n\n These security issues were fixed:\n\n - Prevent One&amp;Done side-channel attack on RSA that allowed physically near\n attackers to use EM emanations to recover information (bsc#1104789)\n - CVE-2018-0737: The RSA Key generation algorithm has been shown to be\n vulnerable to a cache timing side channel attack. An attacker with\n sufficient access to mount cache timing attacks during the RSA key\n generation process could have recovered the private key (bsc#1089039)\n - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E)\n based ciphersuite a malicious server could have sent a very large prime\n value to the client. This caused the client to spend an unreasonably\n long period of time generating a key for this prime resulting in a hang\n until the client has finished. This could be exploited in a Denial Of\n Service attack (bsc#1097158)\n - Make problematic ECDSA sign addition length-invariant\n - Add blinding to ECDSA and DSA signatures to protect against side channel\n attacks\n\n This non-security issue was fixed:\n\n - Add openssl(cli) Provide so the packages that require the openssl binary\n can require this instead of the new openssl meta package (bsc#1101470)\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n", "modified": "2018-10-05T12:11:01", "published": "2018-10-05T12:11:01", "id": "OPENSUSE-SU-2018:3015-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00009.html", "title": "Security update for openssl-1_0_0 (moderate)", "type": "suse", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-11-24T21:04:34", "bulletinFamily": "unix", "description": "This update for openssl fixes the following issues:\n\n Security issues fixed:\n\n - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation\n (bsc#1113652).\n - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack\n defenses (bsc#1113534).\n - Add missing timing side channel patch for DSA signature generation\n (bsc#1113742).\n\n Non-security issues fixed:\n\n - Fixed infinite loop in DSA generation with incorrect parameters\n (bsc#1112209).\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\n\n", "modified": "2018-11-24T18:18:01", "published": "2018-11-24T18:18:01", "id": "OPENSUSE-SU-2018:3903-1", "href": "http://lists.opensuse.org/opensuse-security-announce/2018-11/msg00046.html", "title": "Security update for openssl (moderate)", "type": "suse", "cvss": {"score": 0.0, "vector": "NONE"}}], "aix": [{"lastseen": "2019-05-29T19:19:13", "bulletinFamily": "unix", "description": "IBM SECURITY ADVISORY\n\nFirst Issued: Wed Sep 19 08:44:29 CDT 2018\n\nThe most recent version of this document is available here:\n\nhttp://aix.software.ibm.com/aix/efixes/security/openssl_advisory28.asc\nhttps://aix.software.ibm.com/aix/efixes/security/openssl_advisory28.asc\nftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory28.asc\n\n\nSecurity Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0732)\n\n\n===============================================================================\n\nSUMMARY:\n\n There is a vulnerability in OpenSSL used by AIX.\n\n\n===============================================================================\n\nVULNERABILITY DETAILS:\n\n CVEID: CVE-2018-0732\n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0732\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0732\n DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the\n sending of a very large prime value to the client by a malicious server\n during key agreement in a TLS handshake. By spending an unreasonably\n long period of time generating a key for this prime, a remote attacker\n could exploit this vulnerability to cause the client to hang.\n CVSS Base Score: 5.3\n CVSS Temporal Score: See\n https://exchange.xforce.ibmcloud.com/vulnerabilities/144658\n for the current score\n CVSS Environmental Score*: Undefined\n CVSS Vector:(CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)\n\n\n AFFECTED PRODUCTS AND VERSIONS:\n \n AIX 5.3, 6.1, 7.1, 7.2\n VIOS 2.2.x\n\n The following fileset levels are vulnerable:\n \n key_fileset = osrcaix\n\n Fileset Lower Level Upper Level KEY\n ------------------------------------------------------\n openssl.base 1.0.2.500 1.0.2.1500 key_w_fs\n openssl.base 20.13.102.1000 20.13.102.1500 key_w_fs\n\n Note:\n A. 0.9.8, 1.0.1 OpenSSL versions are out-of-support. Customers are\n advised to upgrade to currently supported OpenSSL 1.0.2 version.\n\n B. Latest level of OpenSSL fileset is available from the web download site:\n https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=aixbp&lang=en_US&S_PKG=openssl&cp=UTF-8\n \n To find out whether the affected filesets are installed on your systems,\n refer to the lslpp command found in the AIX user's guide.\n\n Example: lslpp -L | grep -i openssl.base\n\n REMEDIATION:\n\n FIXES\n\n The fixes can be downloaded via ftp or http from:\n\n ftp://aix.software.ibm.com/aix/efixes/security/openssl_fix28.tar\n http://aix.software.ibm.com/aix/efixes/security/openssl_fix28.tar\n https://aix.software.ibm.com/aix/efixes/security/openssl_fix28.tar\n\n The links above are to a tar file containing this signed\n advisory, fix packages, and OpenSSL signatures for each package.\n The fixes below include prerequisite checking. This will\n enforce the correct mapping between the fixes and AIX\n Technology Levels.\n \n Note that the tar file contains Interim fixes that are based on\n OpenSSL version, and AIX OpenSSL fixes are cumulative.\n\n You must be on the 'prereq for installation' level before\n applying the interim fix. This may require installing a new\n level(prereq version) first.\n\n\n AIX Level Interim Fix (*.Z) Fileset Name(prereq for installation) KEY\n --------------------------------------------------------------------------------------------\n 5.3, 6.1, 7.1, 7.2 102oa_ifix.180906.epkg.Z openssl.base(1.0.2.1500) key_w_fix\n 5.3, 6.1, 7.1, 7.2 fips_102oa.180910.epkg.Z openssl.base(20.13.102.1500) key_w_fix\n\n VIOS Level Interim Fix (*.Z) Fileset Name(prereq for installation) KEY\n --------------------------------------------------------------------------------------------\n 2.2.x 102oa_ifix.180906.epkg.Z openssl.base(1.0.2.1500) key_w_fix \n 2.2.x fips_102oa.180910.epkg.Z openssl.base(20.13.102.1500) key_w_fix\n\n\n To extract the fixes from the tar file:\n\n tar xvf openssl_fix28.tar\n cd openssl_fix28\n\n Verify you have retrieved the fixes intact:\n\n The checksums below were generated using the\n \"openssl dgst -sha256 file\" command as the followng:\n\n openssl dgst -sha256 filename KEY\n -----------------------------------------------------------------------------------------------------\n d060188b871e792bc29752dd4ab4308e8b11e2a90d5dee1902a8b8683a4de9de 102oa_ifix.180906.epkg.Z key_w_csum\n 6edf3bf56a2e4ec9d2e3e0f0a28c00c740f1be5cdb524d050af0b842908b89cd fips_102oa.180910.epkg.Z key_w_csum\n\n These sums should match exactly. The OpenSSL signatures in the tar\n file and on this advisory can also be used to verify the\n integrity of the fixes. If the sums or signatures cannot be\n confirmed, contact IBM AIX Support at\n https://ibm.com/support/ and describe the discrepancy.\n \n openssl dgst -sha1 -verify <pubkey_file> -signature <advisory_file>.sig <advisory_file>\n\n openssl dgst -sha1 -verify <pubkey_file> -signature <ifix_file>.sig <ifix_file>\n\n Published advisory OpenSSL signature file location:\n\n http://aix.software.ibm.com/aix/efixes/security/openssl_advisory28.asc.sig\n https://aix.software.ibm.com/aix/efixes/security/openssl_advisory28.asc.sig\n ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory28.asc.sig\n\n B. FIX AND INTERIM FIX INSTALLATION\n\n Interim fixes have had limited functional and regression\n testing but not the full regression testing that takes place\n for Service Packs; however, IBM does fully support them.\n\n Interim fix management documentation can be found at:\n\n http://www14.software.ibm.com/webapp/set2/sas/f/aix.efixmgmt/home.html\n\n To preview an interim fix installation:\n\n emgr -e ipkg_name -p # where ipkg_name is the name of the\n # interim fix package being previewed.\n\n To install an interim fix package:\n\n emgr -e ipkg_name -X # where ipkg_name is the name of the\n # interim fix package being installed.\n\n\n \n WORKAROUNDS AND MITIGATIONS:\n\n None.\n\n\n===============================================================================\n\nCONTACT US:\n\n Note: Keywords labeled as KEY in this document are used for parsing\n purposes.\n\n If you would like to receive AIX Security Advisories via email,\n please visit \"My Notifications\":\n\n http://www.ibm.com/support/mynotifications\n https://www.ibm.com/support/mynotifications\n\n To view previously issued advisories, please visit:\n\n http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq\n https://www14.software.ibm.com/webapp/set2/subscriptions/onvdq\n \n Contact IBM Support for questions related to this announcement:\n\n http://ibm.com/support/\n https://ibm.com/support/\n\n To obtain the OpenSSL public key that can be used to verify the\n signed advisories and ifixes:\n\n Download the key from our web page:\n\nftp://ftp.software.ibm.com/systems/power/AIX/systems_p_os_aix_security_pubkey.txt\n\n Please contact your local IBM AIX support center for any\n assistance.\n\n\nREFERENCES:\n\n Complete CVSS v3 Guide:\n http://www.first.org/cvss/user-guide\n https://www.first.org/cvss/user-guide\n On-line Calculator v3:\n http://www.first.org/cvss/calculator/3.0\n https://www.first.org/cvss/calculator/3.0\n\n\nRELATED INFORMATION:\n\n Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0732)\n https://www-01.ibm.com/support/docview.wss?uid=ibm10731039\n\n\nACKNOWLEDGEMENTS:\n\n None.\n\n\nCHANGE HISTORY:\n\n First Issued: Wed Sep 19 08:44:29 CDT 2018\n\n\n===============================================================================\n\n*The CVSS Environment Score is customer environment specific and will\nultimately impact the Overall CVSS Score. Customers can evaluate the impact\nof this vulnerability in their environments by accessing the links in the\nReference section of this Security Bulletin.\n\nDisclaimer\nAccording to the Forum of Incident Response and Security Teams (FIRST), the\nCommon Vulnerability Scoring System (CVSS) is an \"industry open standard\ndesigned to convey vulnerability severity and help to determine urgency and\npriority of response.\" IBM PROVIDES THE CVSS SCORES \"AS IS\" WITHOUT WARRANTY\nOF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS\nFOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT\nOF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.\n", "modified": "2018-09-19T08:44:29", "published": "2018-09-19T08:44:29", "id": "OPENSSL_ADVISORY28.ASC", "href": "https://aix.software.ibm.com/aix/efixes/security/openssl_advisory28.asc", "title": "Vulnerability in OpenSSL affects AIX (CVE-2018-0732)", "type": "aix", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T19:19:13", "bulletinFamily": "unix", "description": "IBM SECURITY ADVISORY\n\nFirst Issued: Mon Jul 2 11:24:30 CDT 2018\n\nThe most recent version of this document is available here:\n\nhttp://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc\nhttps://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc\nftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc\n\n\nSecurity Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0737) \n\n\n===============================================================================\n\nSUMMARY:\n\n There is a vulnerability in OpenSSL used by AIX.\n\n\n===============================================================================\n\nVULNERABILITY DETAILS:\n\n CVEID: CVE-2018-0737 \n http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0737\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0737\n DESCRIPTION: The OpenSSL RSA Key generation algorithm has been shown to \n be vulnerable to a cache timing side channel attack. An attacker with \n sufficient access to mount cache timing attacks during the RSA key \n generation process could recover the private key. \n CVSS Base Score: 3.3 \n CVSS Temporal Score: See \n https://exchange.xforce.ibmcloud.com/vulnerabilities/141679 \n for the current score \n CVSS Environmental Score*: Undefined\n CVSS Vector:NA\n\n\n AFFECTED PRODUCTS AND VERSIONS:\n \n AIX 5.3, 6.1, 7.1, 7.2\n VIOS 2.2.x\n\n The following fileset levels are vulnerable:\n \n key_fileset = osrcaix\n\n Fileset Lower Level Upper Level KEY \n ------------------------------------------------------\n openssl.base 1.0.2.500 1.0.2.1300 key_w_fs\n openssl.base 20.13.102.1000 20.13.102.1300 key_w_fs\n\n Note: \n A. 0.9.8, 1.0.1 OpenSSL versions are out-of-support. Customers are \n advised to upgrade to currently supported OpenSSL 1.0.2 version.\n\n B. Latest level of OpenSSL fileset is available from the web download site:\n https://www14.software.ibm.com/webapp/iwm/web/reg/download.do?source=aixbp&lang=en_US&S_PKG=openssl&cp=UTF-8\n \n To find out whether the affected filesets are installed on your systems, \n refer to the lslpp command found in the AIX user's guide.\n\n Example: lslpp -L | grep -i openssl.base\n\n REMEDIATION:\n\n FIXES\n\n A fix is available, and it can be downloaded from:\n\n https://www14.software.ibm.com/webapp/iwm/web/preLogin.do?source=aixbp\n\n To extract the fixes from the tar file:\n\n For Openssl 1.0.2 version - \n zcat openssl-1.0.2.1500.tar.Z | tar xvf -\n\n For 1.0.2 FIPS capable openssl version -\n zcat openssl-20.13.102.1500.tar.Z | tar xvf -\n \n\n IMPORTANT: If possible, it is recommended that a mksysb backup\n of the system be created. Verify it is both bootable and\n readable before proceeding.\n\n Note that all the previously reported security vulnerability fixes\n are also included in above mentioned fileset level. Please refer to \n the readme file (provided along with the fileset) for the complete\n list of vulnerabilities fixed.\n\n To preview the fix installation:\n\n installp -apYd . openssl\n\n To install the fix package:\n\n installp -aXYd . openssl\n \n \n openssl dgst -sha1 -verify <pubkey_file> -signature <advisory_file>.sig <advisory_file>\n\n openssl dgst -sha1 -verify <pubkey_file> -signature <ifix_file>.sig <ifix_file>\n\n Published advisory OpenSSL signature file location:\n \n http://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc.sig\n https://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc.sig\n ftp://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc.sig \n\n \n WORKAROUNDS AND MITIGATIONS:\n\n None.\n\n\n===============================================================================\n\nCONTACT US:\n\n Note: Keywords labeled as KEY in this document are used for parsing\n purposes.\n\n If you would like to receive AIX Security Advisories via email,\n please visit \"My Notifications\":\n\n http://www.ibm.com/support/mynotifications\n https://www.ibm.com/support/mynotifications\n\n To view previously issued advisories, please visit:\n\n http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq\n https://www14.software.ibm.com/webapp/set2/subscriptions/onvdq\n \n Contact IBM Support for questions related to this announcement:\n\n http://ibm.com/support/\n https://ibm.com/support/\n\n To obtain the OpenSSL public key that can be used to verify the\n signed advisories and ifixes:\n\n Download the key from our web page:\n\n http://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt\n https://www.ibm.com/systems/resources/systems_p_os_aix_security_pubkey.txt\n\n Please contact your local IBM AIX support center for any\n assistance.\n\n\nREFERENCES:\n \n Complete CVSS v3 Guide: \n http://www.first.org/cvss/user-guide\n https://www.first.org/cvss/user-guide\n On-line Calculator v3:\n http://www.first.org/cvss/calculator/3.0\n https://www.first.org/cvss/calculator/3.0\n\n\nRELATED INFORMATION:\n\n Security Bulletin: Vulnerability in OpenSSL affects AIX (CVE-2018-0737)\n http://www.ibm.com/support/docview.wss?uid=ibm10713441\n\n\nACKNOWLEDGEMENTS:\n\n None.\n\n\nCHANGE HISTORY:\n\n First Issued: Mon Jul 2 11:24:30 CDT 2018\n\n\n===============================================================================\n\n*The CVSS Environment Score is customer environment specific and will \nultimately impact the Overall CVSS Score. Customers can evaluate the impact \nof this vulnerability in their environments by accessing the links in the \nReference section of this Security Bulletin. \n\nDisclaimer\nAccording to the Forum of Incident Response and Security Teams (FIRST), the \nCommon Vulnerability Scoring System (CVSS) is an \"industry open standard \ndesigned to convey vulnerability severity and help to determine urgency and \npriority of response.\" IBM PROVIDES THE CVSS SCORES \"AS IS\" WITHOUT WARRANTY \nOF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS \nFOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT \nOF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.\n\n\n\n\n", "modified": "2018-07-02T11:24:30", "published": "2018-07-02T11:24:30", "id": "OPENSSL_ADVISORY27.ASC", "href": "https://aix.software.ibm.com/aix/efixes/security/openssl_advisory27.asc", "title": "Vulnerability in OpenSSL affects AIX (CVE-2018-0737)", "type": "aix", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "paloalto": [{"lastseen": "2020-03-02T18:33:28", "bulletinFamily": "software", "description": "The OpenSSL library has been updated in PAN-OS to resolve CVE-2019-1559. This is a cryptographic vulnerability that under certain situations may allow a remote attacker to decrypt data by observing server responses to different types of errors.\nThis issue affects Palo Alto Networks PAN-OS 7.1 versions prior to 7.1.25, 8.0 versions prior to 8.0.20, 8.1 versions prior to 8.1.8, 9.0 versions prior to 9.0.2.\nPAN-OS version 7.0 and prior EOL versions have not been evaluated for this issue.\n\n\n**Work around:**\nThere are no available workarounds.", "modified": "2019-12-04T17:00:00", "published": "2019-12-04T17:00:00", "id": "PAN-SA-2019-0039", "href": "https://securityadvisories.paloaltonetworks.com/CVE-2019-1559", "title": "OpenSSL vulnerability CVE-2019-1559 has been resolved in PAN-OS", "type": "paloalto", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "hackerone": [{"lastseen": "2018-09-20T17:51:25", "bulletinFamily": "bugbounty", "bounty": 500.0, "description": "https://www.openssl.org/news/secadv/20180612.txt\n\n```\nOpenSSL Security Advisory [12 June 2018]\n========================================\n\nClient DoS due to large DH parameter (CVE-2018-0732)\n====================================================\n\nSeverity: Low\n\nDuring key agreement in a TLS handshake using a DH(E) based ciphersuite a\nmalicious server can send a very large prime value to the client. This will\ncause the client to spend an unreasonably long period of time generating a key\nfor this prime resulting in a hang until the client has finished. This could be\nexploited in a Denial Of Service attack.\n\nDue to the low severity of this issue we are not issuing a new release of\nOpenSSL 1.1.0 or 1.0.2 at this time. The fix will be included in OpenSSL 1.1.0i\nand OpenSSL 1.0.2p when they become available. The fix is also available in\ncommit ea7abeeab (for 1.1.0) and commit 3984ef0b7 (for 1.0.2) in the OpenSSL git\nrepository.\n\nThis issue was reported to OpenSSL on 5th June 2018 by Guido Vranken who also\ndeveloped the fix.\n```\n\n## Impact\n\nClient DoS", "modified": "2018-09-20T09:06:18", "published": "2018-06-12T11:15:31", "id": "H1:364964", "href": "https://hackerone.com/reports/364964", "type": "hackerone", "title": "OpenSSL (IBB): Client DoS due to large DH parameter (CVE-2018-0732)", "cvss": {"score": 0.0, "vector": "NONE"}}], "oraclelinux": [{"lastseen": "2019-08-14T08:39:03", "bulletinFamily": "unix", "description": "[1.0.2k-19.0.1]\n- Bump release for rebuild.\n[1.0.2k-19]\n- close the RSA decryption 9 lives of Bleichenbacher cat\n timing side channel (#1649568)\n[1.0.2k-18]\n- fix CVE-2018-0734 - DSA signature local timing side channel\n- fix CVE-2019-1559 - 0-byte record padding oracle\n- close the RSA decryption One & done EM side channel (#1619558)\n[1.0.2k-17]\n- use SHA-256 in FIPS RSA pairwise key check\n- fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local\n timing side-channel key extraction", "modified": "2019-08-13T00:00:00", "published": "2019-08-13T00:00:00", "id": "ELSA-2019-2304", "href": "http://linux.oracle.com/errata/ELSA-2019-2304.html", "title": "openssl security and bug fix update", "type": "oraclelinux", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-08-19T21:14:00", "bulletinFamily": "unix", "description": "[1.0.2k-19.0.1]\n- Bump release for rebuild.\n[1.0.2k-19]\n- close the RSA decryption 9 lives of Bleichenbacher cat\n timing side channel (#1649568)\n[1.0.2k-18]\n- fix CVE-2018-0734 - DSA signature local timing side channel\n- fix CVE-2019-1559 - 0-byte record padding oracle\n- close the RSA decryption One & done EM side channel (#1619558)\n[1.0.2k-17]\n- use SHA-256 in FIPS RSA pairwise key check\n- fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local\n timing side-channel key extraction", "modified": "2019-08-19T00:00:00", "published": "2019-08-19T00:00:00", "id": "ELSA-2019-4754", "href": "http://linux.oracle.com/errata/ELSA-2019-4754.html", "title": "openssl security update", "type": "oraclelinux", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2019-08-14T10:36:20", "bulletinFamily": "unix", "description": "[1.0.1e-58.0.1]\n- Oracle bug 28730228: backport CVE-2018-0732\n- Oracle bug 28758493: backport CVE-2018-0737\n- Merge upstream patch to fix CVE-2018-0739\n- Avoid out-of-bounds read. Fixes CVE 2017-3735. By Rich Salz\n- sha256 is used for the RSA pairwise consistency test instead of sha1\n[1.0.1e-58]\n- fix CVE-2019-1559 - 0-byte record padding oracle", "modified": "2019-08-14T00:00:00", "published": "2019-08-14T00:00:00", "id": "ELSA-2019-2471", "href": "http://linux.oracle.com/errata/ELSA-2019-2471.html", "title": "openssl security update", "type": "oraclelinux", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:38:10", "bulletinFamily": "unix", "description": "[1.0.1e-57.0.6]\n- Oracle bug 28730228: backport CVE-2018-0732\n- Oracle bug 28758493: backport CVE-2018-0737", "modified": "2018-10-12T00:00:00", "published": "2018-10-12T00:00:00", "id": "ELSA-2018-4248", "href": "http://linux.oracle.com/errata/ELSA-2018-4248.html", "title": "openssl security update", "type": "oraclelinux", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:35:06", "bulletinFamily": "unix", "description": "[1.0.2k-12.0.3]\n- Oracle bug 28672370: backport CVE-2018-0732\n- Oracle bug 28672351: backport CVE-2018-0737", "modified": "2018-10-12T00:00:00", "published": "2018-10-12T00:00:00", "id": "ELSA-2018-4249", "href": "http://linux.oracle.com/errata/ELSA-2018-4249.html", "title": "openssl security update", "type": "oraclelinux", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:38:29", "bulletinFamily": "unix", "description": "[1.0.2k-12.0.3]\n- Oracle bug 28672370: backport CVE-2018-0732\n- Oracle bug 28672351: backport CVE-2018-0737", "modified": "2018-10-15T00:00:00", "published": "2018-10-15T00:00:00", "id": "ELSA-2018-4253", "href": "http://linux.oracle.com/errata/ELSA-2018-4253.html", "title": "openssl security update", "type": "oraclelinux", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-29T18:35:59", "bulletinFamily": "unix", "description": "[1.0.1e-57.0.6]\n- Oracle bug 28730228: backport CVE-2018-0732\n- Oracle bug 28758493: backport CVE-2018-0737", "modified": "2018-10-15T00:00:00", "published": "2018-10-15T00:00:00", "id": "ELSA-2018-4254", "href": "http://linux.oracle.com/errata/ELSA-2018-4254.html", "title": "openssl security update", "type": "oraclelinux", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "slackware": [{"lastseen": "2019-05-30T07:37:07", "bulletinFamily": "unix", "description": "New openssl packages are available for Slackware 14.2 and -current to\nfix security issues.\n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n\npatches/packages/openssl-1.0.2p-i586-1_slack14.2.txz: Upgraded.\n This update fixes two low severity security issues:\n Client DoS due to large DH parameter.\n Cache timing vulnerability in RSA Key Generation.\n For more information, see:\n https://www.openssl.org/news/secadv/20180612.txt\n https://www.openssl.org/news/secadv/20180416.txt\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0732\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0737\n (* Security fix *)\npatches/packages/openssl-solibs-1.0.2p-i586-1_slack14.2.txz: Upgraded.\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the &quot;Get Slack&quot; section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated packages for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-1.0.2p-i586-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-solibs-1.0.2p-i586-1_slack14.2.txz\n\nUpdated packages for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-1.0.2p-x86_64-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-solibs-1.0.2p-x86_64-1_slack14.2.txz\n\nUpdated packages for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-1.1.0i-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-1.1.0i-i586-1.txz\n\nUpdated packages for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/openssl-solibs-1.1.0i-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssl-1.1.0i-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.2 packages:\ncf7c40e9c66711e028671a7bb38abd99 openssl-1.0.2p-i586-1_slack14.2.txz\nd2850088b0aed90a45aa250ebffad451 openssl-solibs-1.0.2p-i586-1_slack14.2.txz\n\nSlackware x86_64 14.2 packages:\n9d42083aaf9c4854928ec380307ebabb openssl-1.0.2p-x86_64-1_slack14.2.txz\nfd566d85eb3c5cbd82e90b7215b61c91 openssl-solibs-1.0.2p-x86_64-1_slack14.2.txz\n\nSlackware -current packages:\nbd79b75ed5522f75945612c2e2f5dcb8 a/openssl-solibs-1.1.0i-i586-1.txz\n9aaa879284e70161ee40224c2b4660e3 n/openssl-1.1.0i-i586-1.txz\n\nSlackware x86_64 -current packages:\ndadf088e88d02b583c21b1855ba875b5 a/openssl-solibs-1.1.0i-x86_64-1.txz\n3ee4aa3c24eb8be63ed67a5391edffe4 n/openssl-1.1.0i-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the packages as root:\n > upgradepkg openssl-*.txz", "modified": "2018-08-14T17:18:35", "published": "2018-08-14T17:18:35", "id": "SSA-2018-226-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.428354", "title": "openssl", "type": "slackware", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2019-05-30T07:36:40", "bulletinFamily": "unix", "description": "New openssl packages are available for Slackware 14.2 and -current to\nfix security issues.\n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n\npatches/packages/openssl-1.0.2q-i586-1_slack14.2.txz: Upgraded.\n This update fixes a timing side-channel flaw on processors which implement\n SMT/Hyper-Threading architectures, and a side channel attack on DSA\n signature generation that could allow an attacker to recover the private key.\n For more information, see:\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5407\n https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0734\n (* Security fix *)\npatches/packages/openssl-solibs-1.0.2q-i586-1_slack14.2.txz: Upgraded.\n\nWhere to find the new packages:\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the &quot;Get Slack&quot; section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated packages for Slackware 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/openssl-1.0.1u-i486-1_slack14.0.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/openssl-solibs-1.0.1u-i486-1_slack14.0.txz\n\nUpdated packages for Slackware x86_64 14.0:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/openssl-1.0.1u-x86_64-1_slack14.0.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/openssl-solibs-1.0.1u-x86_64-1_slack14.0.txz\n\nUpdated packages for Slackware 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/openssl-1.0.1u-i486-1_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/openssl-solibs-1.0.1u-i486-1_slack14.1.txz\n\nUpdated packages for Slackware x86_64 14.1:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/openssl-1.0.1u-x86_64-1_slack14.1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/openssl-solibs-1.0.1u-x86_64-1_slack14.1.txz\n\nUpdated packages for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-1.0.2q-i586-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-solibs-1.0.2q-i586-1_slack14.2.txz\n\nUpdated packages for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-1.0.2q-x86_64-1_slack14.2.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-solibs-1.0.2q-x86_64-1_slack14.2.txz\n\nUpdated packages for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-1.1.1a-i586-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-1.1.1a-i586-1.txz\n\nUpdated packages for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/openssl-solibs-1.1.1a-x86_64-1.txz\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssl-1.1.1a-x86_64-1.txz\n\n\nMD5 signatures:\n\nSlackware 14.0 packages:\ne6d4b3a76383f9f253da4128ba23f269 openssl-1.0.1u-i486-1_slack14.0.txz\nc61d31a1751ae39af89d3fee0b54f0d8 openssl-solibs-1.0.1u-i486-1_slack14.0.txz\n\nSlackware x86_64 14.0 packages:\n96be19e6a96c9beb5d3bbc55348fb483 openssl-1.0.1u-x86_64-1_slack14.0.txz\nb7a8fa2ebd16c8ae106fc1267bc29eca openssl-solibs-1.0.1u-x86_64-1_slack14.0.txz\n\nSlackware 14.1 packages:\n099b960e62eaea5d1a639a61a2fabca7 openssl-1.0.1u-i486-1_slack14.1.txz\nb5d5219e05db97f63c4d6c389d6884fb openssl-solibs-1.0.1u-i486-1_slack14.1.txz\n\nSlackware x86_64 14.1 packages:\nfc96c87d76c9d1efd1290ac847fa7c7c openssl-1.0.1u-x86_64-1_slack14.1.txz\ne873b66f84f45ea34d028a3d524ce573 openssl-solibs-1.0.1u-x86_64-1_slack14.1.txz\n\nSlackware 14.2 packages:\nd5f0cc19451e9c7e3967820cf02a20c6 openssl-1.0.2q-i586-1_slack14.2.txz\n594ca80447baecd608a51083b12a26d9 openssl-solibs-1.0.2q-i586-1_slack14.2.txz\n\nSlackware x86_64 14.2 packages:\n943bb2f3259ccf97a1b8b25f5f511c30 openssl-1.0.2q-x86_64-1_slack14.2.txz\n0d45afe2487c47b283c06902c56e4559 openssl-solibs-1.0.2q-x86_64-1_slack14.2.txz\n\nSlackware -current packages:\n6f01f6dd0f40a12e473320386cfc8536 a/openssl-solibs-1.1.1a-i586-1.txz\n6e5a2ab2475a0d851376d12911b3c6b7 n/openssl-1.1.1a-i586-1.txz\n\nSlackware x86_64 -current packages:\neb4697703f1f4b81ad38e9247ab70dac a/openssl-solibs-1.1.1a-x86_64-1.txz\n12a10fd6bd2344b3e73106c8d5b9828c n/openssl-1.1.1a-x86_64-1.txz\n\n\nInstallation instructions:\n\nUpgrade the packages as root:\n > upgradepkg openssl-1.0.2q-i586-1_slack14.2.txz openssl-solibs-1.0.2q-i586-1_slack14.2.txz", "modified": "2018-11-21T22:43:55", "published": "2018-11-21T22:43:55", "id": "SSA-2018-325-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.576913", "title": "openssl", "type": "slackware", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "gentoo": [{"lastseen": "2019-03-14T05:50:17", "bulletinFamily": "unix", "description": "### Background\n\nOpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library. \n\n### Description\n\nMultiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding. \n\nA local attacker could run a malicious process next to legitimate processes using the architecture\u2019s parallel thread running capabilities to leak encrypted data from the CPU\u2019s internal processes. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll OpenSSL users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=dev-libs/openssl-1.0.2r\"", "modified": "2019-03-14T00:00:00", "published": "2019-03-14T00:00:00", "id": "GLSA-201903-10", "href": "https://security.gentoo.org/glsa/201903-10", "title": "OpenSSL: Multiple vulnerabilities", "type": "gentoo", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}}], "amazon": [{"lastseen": "2019-05-29T19:20:40", "bulletinFamily": "unix", "description": "**Issue Overview:**\n\nA microprocessor side-channel vulnerability was found on SMT (e.g, Hyper-Threading) architectures. An attacker running a malicious process on the same core of the processor as the victim process can extract certain secret information. ([CVE-2018-5407 __](<https://access.redhat.com/security/cve/CVE-2018-5407>))\n\nIf an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \"non-stitched\" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). \n([CVE-2019-1559 __](<https://access.redhat.com/security/cve/CVE-2019-1559>))\n\n \n**Affected Packages:** \n\n\nopenssl\n\n \n**Issue Correction:** \nRun _yum update openssl_ to update your system. \n\n\n \n\n\n**New Packages:**\n \n \n i686: \n openssl-debuginfo-1.0.2k-16.150.amzn1.i686 \n openssl-1.0.2k-16.150.amzn1.i686 \n openssl-static-1.0.2k-16.150.amzn1.i686 \n openssl-devel-1.0.2k-16.150.amzn1.i686 \n openssl-perl-1.0.2k-16.150.amzn1.i686 \n \n src: \n openssl-1.0.2k-16.150.amzn1.src \n \n x86_64: \n openssl-1.0.2k-16.150.amzn1.x86_64 \n openssl-static-1.0.2k-16.150.amzn1.x86_64 \n openssl-devel-1.0.2k-16.150.amzn1.x86_64 \n openssl-debuginfo-1.0.2k-16.150.amzn1.x86_64 \n openssl-perl-1.0.2k-16.150.amzn1.x86_64 \n \n \n", "modified": "2019-04-09T16:10:00", "published": "2019-04-09T16:10:00", "id": "ALAS-2019-1188", "href": "https://alas.aws.amazon.com/ALAS-2019-1188.html", "title": "Medium: openssl", "type": "amazon", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "redhat": [{"lastseen": "2019-08-15T00:44:53", "bulletinFamily": "unix", "description": "OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: 0-byte record padding oracle (CVE-2019-1559)\n\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.", "modified": "2019-08-06T13:43:39", "published": "2019-08-06T12:23:32", "id": "RHSA-2019:2304", "href": "https://access.redhat.com/errata/RHSA-2019:2304", "type": "redhat", "title": "(RHSA-2019:2304) Moderate: openssl security and bug fix update", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "centos": [{"lastseen": "2019-12-20T18:28:02", "bulletinFamily": "unix", "description": "**CentOS Errata and Security Advisory** CESA-2019:2304\n\n\nOpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\n\nSecurity Fix(es):\n\n* openssl: 0-byte record padding oracle (CVE-2019-1559)\n\n* openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2019-August/006031.html\n\n**Affected packages:**\nopenssl\nopenssl-devel\nopenssl-libs\nopenssl-perl\nopenssl-static\n\n**Upstream details at:**\n", "modified": "2019-08-30T03:49:42", "published": "2019-08-30T03:49:42", "id": "CESA-2019:2304", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2019-August/006031.html", "title": "openssl security update", "type": "centos", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}]}