OracleVM 3.4 : openssl (OVMSA-2019-0040)

The remote OracleVM system is missing necessary patches to address critical security updates : - Oracle bug 28730228: backport CVE-2018-0732 - Oracle bug 28758493: backport CVE-2018-0737 - Merge upstream patch to fix CVE-2018-0739 - Avoid out-of-bounds read. Fixes CVE-2017-3735. By Rich Salz -...

openssl security update

1.0.1e-58.0.1 - Oracle bug 28730228: backport CVE-2018-0732 - Oracle bug 28758493: backport CVE-2018-0737 - Merge upstream patch to fix CVE-2018-0739 - Avoid out-of-bounds read. Fixes CVE 2017-3735. By Rich Salz - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.1e-58 - fi...

openssl security update

1.0.1e-58.0.1 - Oracle bug 28730228: backport CVE-2018-0732 - Oracle bug 28758493: backport CVE-2018-0737 - Merge upstream patch to fix CVE-2018-0739 - Avoid out-of-bounds read. Fixes CVE 2017-3735. By Rich Salz - sha256 is used for the RSA pairwise consistency test instead of sha1 1.0.1e-58 - fi...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Spectrum Protect Plus (CVE-2018-0739, CVE-2018-0737, CVE-2018-0732)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project on March 27, 2018, April 16, 2018, and June 12, 2018. OpenSSL, used by IBM Spectrum Protect Plus, has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2018-0739 DESCRIPTION: OpenSSL is vulnerable to a denial of...

EulerOS 2.0 SP8 : compat-openssl10 (EulerOS-SA-2019-1643)

According to the versions of the compat-openssl10 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the clien...

SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)

This update for openssl fixes the following issues : CVE-2018-0732: Reject excessively large primes in DH key generation bsc1097158 CVE-2018-0734: Timing vulnerability in DSA signature generation bsc1113652 CVE-2018-0737: Cache timing vulnerability in RSA Key Generation bsc1089039 CVE-2018-5407:...

Palo Alto Networks PAN-OS 6.1.x <= 6.1.20 / 7.1.x < 7.1.21 / 8.0.x < 8.0.14 / 8.1.x < 8.1.4 Multiple Vulnerabilities (PAN-SA-2018-0015)

The version of Palo Alto Networks PAN-OS running on the remote host is 6.1.x including 6.1.20 or 7.1.x prior to 7.1.21 or 8.0.x prior to 8.0.14 or 8.1.x prior to 8.1.4. It is, therefore, affected by multiple vulnerabilities : - A denial of service DoS vulnerability that exists in OpenSSL due to...

Security Bulletin: IBM Security Proventia Network Active Bypass is affected by openssl vulnerabilities (CVE-2018-0737)

Summary IBM Security Proventia Network Active Bypass has addressed the following vulnerabilities. CVE-2018-0737 Vulnerability Details CVEID: CVE-2018-0737 DESCRIPTION: OpenSSL could allow a local attacker to obtain sensitive information, caused by a cache-timing side channel attack in the RSA Key...

Photon OS 2.0: Openssl PHSA-2018-2.0-0078

An update of the openssl package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-2.0-0078. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 1.0: Openssl PHSA-2018-1.0-0149

An update of the openssl package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2018-1.0-0149. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2019:0197-1)

This update for openssl-11 fixes the following issues : Security issues fixed : The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations bsc1117951 Fix FIPS RSA generator bsc1118913 Note that Tenable Network Security has extracted the preceding description block directly from the...

Oracle Primavera P6 Enterprise Project Portfolio Management (EPPM) Multiple Vulnerabilities (Jan 2019 CPU)

According to its self-reported version number, the Oracle Primavera P6 Enterprise Project Portfolio Management EPPM installation running on the remote web server is 8.4 prior to 8.4.15.9, 15.x prior to 15.2.18.3, 16.x prior to 16.2.17.0, 17.x prior to 17.12.10.0, or 18.x prior to 18.8.5.0. It is,...

Junos OS: OpenSSL Security Advisories [16 Apr 2018] and [12 June 2018] (JSA10919)

According to its self-reported version number, the remote Juniper Junos device is affected by a multiple vulnerabilities: - During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend...

Tenable Nessus < 7.1.4 Multiple Vulnerabilities (TNS-2018-17)

Tenable Nessus is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tenable:nessus"; ifdescripti...

EulerOS 2.0 SP5 : openssl (EulerOS-SA-2019-1009)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 - openssl: Malicious server can send large prime to...

Fedora 28 : 1:openssl (2018-520e4c5b4e)

Update to 1.1.0i version from upstream fixing minor security issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

SUSE SLES15 Security Update : openssl-1_0_0 (SUSE-SU-2018:2965-1)

This update for openssl-100 to 1.0.2p fixes the following issues : These security issues were fixed : Prevent One&Done side-channel attack on RSA that allowed physically near attackers to use EM emanations to recover information bsc1104789 CVE-2018-0737: The RSA Key generation algorithm has been...

[SECURITY] [DSA 4355-1] openssl1.0 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4355-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 19, 2018 https://www.debian.org/security/faq -...

Security Advisory - Cache Timing Vulnerability in OpenSSL RSA Key Generation

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack CVE-2018-0737. An attacker could exploit this vulnerability to recover the private key. Vulnerability ID: HWPSIRT-2018-06015 Huawei has released software updates to fix this vulnerabilit...

Security Bulletin: IBM Cloud Manager with OpenStack is affected by a OpenSSL vulnerabilities (CVE-2018-0732, CVE-2018-0737)

Summary A security vulnerability has been identified in OpenSSL that is used by IBM Cloud Manager with OpenStack. IBM Cloud Manager with OpenStack has addressed this vulnerability. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the...