EulerOS 2.0 SP3 : libgcrypt (EulerOS-SA-2019-2006)

According to the versions of the libgcrypt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization,...

EulerOS 2.0 SP3 : openssl (EulerOS-SA-2019-2008)

According to the version of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signi...

EulerOS 2.0 SP5 : nss-softokn (EulerOS-SA-2019-1979)

According to the version of the nss-softokn packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of...

OPENSUSE-SU-2019:2158-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: OpenSSL Security Advisory 10 September 2019 CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance. bsc1150003 CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250 This update was...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2019:2410-1)

This update for openssl-11 fixes the following issues : OpenSSL Security Advisory 10 September 2019 CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance. bsc1150003 CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250 Note that Tenab...

SUSE-SU-2019:2413-1 Security update for openssl

This update for openssl fixes the following issues: OpenSSL Security Advisory 10 September 2019 - CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance bsc1150003. - CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250...

SUSE-SU-2019:2410-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: OpenSSL Security Advisory 10 September 2019 CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance. bsc1150003 CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250...

FreeBSD : Mbed TLS -- Side channel attack on deterministic ECDSA (1c948fd3-dac0-11e9-81b2-0011d823eebd)

Janos Follath reports : Mbed TLS does not have a constant-time/constant-trace arithmetic library and uses blinding to protect against side channel attacks. In the ECDSA signature routine previous Mbed TLS versions used the same RNG object for generating the ephemeral key pair and for generating t...

SUSE-SU-2019:14174-1 Security update for openssl

This update for openssl fixes the following issues: OpenSSL Security Advisory 10 September 2019 - CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance bsc1150003. - CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250...

SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2019:2403-1)

This update for openssl-11 fixes the following issues : OpenSSL Security Advisory 10 September 2019 CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance. bsc1150003 CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250 Note that Tenab...

SUSE SLES12 Security Update : openssl (SUSE-SU-2019:2397-1)

This update for openssl fixes the following issues : OpenSSL Security Advisory 10 September 2019 CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance. bsc1150003 CVE-2019-1563: Fixed a Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250 Note that Tenabl...

SUSE-SU-2019:2397-1 Security update for openssl

This update for openssl fixes the following issues: - OpenSSL Security Advisory 10 September 2019 CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance. bsc1150003 CVE-2019-1563: Fixed a Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250...

SUSE-SU-2019:14171-1 Security update for openssl1

This update for openssl1 fixes the following issues: OpenSSL Security Advisory 10 September 2019 CVE-2019-1547: Added ECGROUPsetgenerator side channel attack avoidance. bsc1150003 CVE-2019-1563: Fixed Bleichenbacher attack against cms/pkcs7 encryption transported key bsc1150250...

EulerOS Virtualization for ARM 64 3.0.2.0 : openssl (EulerOS-SA-2019-1943)

According to the version of the openssl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could u...

Intel CPUs Vulnerable to Sensitive Data Leakage in NetCAT Attack

Researchers have identified a new side-channel attack impacting all modern Intel server processors made since 2012. The vulnerability could allow bad actors to sniff out encrypted passwords as they are being typed into a secure shell session SSH; but, luckily, such an attack would be difficult to...

Side-Channel Attack

openssl is vulnerable to side channel attacks. The library falls back to non-side channel resistant code paths when an OpenSSL EC group is constructed without a cofactor present, using explicit parameters instead of a named curve. This can result in the recovery of the full key during an ECDSA...

OVMF security update

CentOS Errata and Security Advisory CESA-2019:2125 An update for ovmf is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Scientific Linux Security Update : openssl on SL7.x x86_64 (20190806)

Security Fixes : - openssl: 0-byte record padding oracle CVE-2019-1559 - openssl: timing side channel attack in the DSA signature algorithm CVE-2018-0734 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid128247;...

Ubuntu 18.04 LTS : wpa_supplicant and hostapd vulnerability (USN-4098-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4098-1 advisory. It was discovered that wpasupplicant and hostapd were vulnerable to a side channel attack against EAP- pwd. A remote attacker could possibly use this issue to...

Important kernel security update: New kernel 2.6.32-042stab140.1; Virtuozzo 6.0 Update 12 Hotfix 45 (6.0.12-3747)

This update provides a new kernel 2.6.32-042stab140.1 for Virtuozzo 6.0 based on the RHEL 6.10 kernel 2.6.32-754.18.2.el6. The new kernel inherits security fixes from the RHEL kernel and features internal fixes. Vulnerability id: CVE-2019-5489 A new software page cache side channel attack scenari...