CBL Mariner 2.0 Security Update: m2crypto (CVE-2020-25657)

The version of m2crypto installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-25657 advisory. - A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing...

Fedora 36 : gnutls / guile-gnutls (2023-4fc4c33f2b)

The remote Fedora 36 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-4fc4c33f2b advisory. Release of gnutls 3.8.0 fixes CVE-2023-0361 Release of gnutls guile bingings as standalone package. Tenable has extracted the preceding description block...

gnutls: timing side-channel in the TLS RSA key exchange code

A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side-channel may be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, the attacker would need to send ...

openssl: timing attack in RSA Decryption implementation

A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover a ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, an attacker would have to be able to send a very large number of trial messages...

RHEL 9 : gnutls (RHSA-2023:1200)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1200 advisory. The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS...

AlmaLinux 9 : gnutls (ALSA-2023:1141)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:1141 advisory. - A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypte...

Fedora 38 : gnutls / guile-gnutls (2023-5b378b82b3)

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-5b378b82b3 advisory. Release of gnutls 3.8.0 fixes CVE-2023-0361 Release of gnutls guile bingings as standalone package. Tenable has extracted the preceding description block...

RHEL 9 : gnutls (RHSA-2023:1141)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1141 advisory. The gnutls packages provide the GNU Transport Layer Security GnuTLS library, which implements cryptographic algorithms and protocols such as SSL, TLS...

SUSE SLES12 Security Update : python-rsa (SUSE-SU-2023:0648-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0648-1 advisory. - CVE-2020-25658: Fixed a Bleichenbacher timing oracle attack against RSA decryption bsc1178676. Tenable has extracted the preceding...

Oracle Linux 9 : gnutls (ELSA-2023-1141)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-1141 advisory. 3.7.6-18 - Update gnutls-3.7.8-fips-pct-dh.patch to the upstream version 2168610 3.7.6-17 - Fix timing side-channel in TLS RSA key exchange 2162600 3.7.6-16 -...

SUSE-SU-2023:0648-1 Security update for python-rsa

This update for python-rsa fixes the following issues: - CVE-2020-25658: Fixed a Bleichenbacher timing oracle attack against RSA decryption bsc1178676...

gnutls: timing side-channel in the TLS RSA key exchange code

A timing side-channel vulnerability was found in RSA ClientKeyExchange messages in GnuTLS. This side-channel may be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, the attacker would need to send ...

Tenable SecurityCenter <= 5.23.1 Multiple Vulnerabilities (TNS-2023-08)

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is running a version between 5.21.0 and 5.23.1 and is therefore affected by multiple vulnerabilities in OpenSSL prior to version 1.1.1t: - A timing based side channel exists in the OpenSSL...

SUSE SLES15: gnutls / libgnutls-devel / libgnutls30 / libgnutls30-32bit / etc (SUSE-SU-2023:0610-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:0610-1 advisory. - CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange bsc1208143. Tenable has extracted the preceding description block directly...

SUSE SLES15 Security Update : python-cryptography, python-cryptography-vectors (SUSE-SU-2023:0604-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0604-1 advisory. - Update in SLE-15 bsc1199282, jscPM-3243, jscSLE-24629 - CVE-2020-36242: Fixed a bug where certain sequences of update calls could...

SUSE-SU-2023:0604-1 Security update for python-cryptography, python-cryptography-vectors

This update for python-cryptography, python-cryptography-vectors fixes the following issues: - Update in SLE-15 bsc1199282, jscPM-3243, jscSLE-24629 - CVE-2020-36242: Fixed a bug where certain sequences of update calls could result in integer overflow bsc1182066. - CVE-2020-25659: Fixed...

SUSE SLES12 Security Update : compat-openssl098 (SUSE-SU-2023:0581-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:0581-1 advisory. - CVE-2022-4304: Fixed timing Oracle in RSA Decryption bsc1207534. Tenable has extracted the preceding description block directly from the...

openssl: timing attack in RSA Decryption implementation

A timing-based side channel exists in the OpenSSL RSA Decryption implementation, which could be sufficient to recover a ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption, an attacker would have to be able to send a very large number of trial messages...

AlmaLinux 9 : openssl (ALSA-2023:0946)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0946 advisory. - A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after...

Ubuntu 20.04 LTS / 22.04 LTS : GnuTLS vulnerability (USN-5901-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5901-1 advisory. Hubert Kario discovered that GnuTLS had a timing side-channel when handling certain RSA messages. A remote attacker could possibly use this issue to...