SUSE: Security Advisory (SUSE-SU-2023:3179-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: libopenssl-1_1-devel / libopenssl-1_1-devel-32bit / libopenssl1_1 / etc (SUSE-SU-2023:3179-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3179-1 advisory. - CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out...

Tenable Nessus < 10.5.4 Multiple Vulnerabilities (TNS-2023-27)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.5.4. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-27 advisory. - Nessus leverages third-party software to help provide underlying functionality...

USN-6275-1: Cargo vulnerability

Addison Crump discovered that Cargo incorrectly set file permissions on UNIX-like systems when extracting crate archives. If the crate would contain files writable by any user, a local attacker could possibly use this issue to execute code as another user...

Qualys Expands Cloud Platform for First-Party Application Risk Detection and Remediation

Have you faced the need to identify & respond to open-source package vulnerabilities like log4shell, openSSL, etc, in production from Day Zero? Are you using first-party, homegrown applications and are worried the risk introduced by those applications is not seen or addressed? Qualys new...

SUSE-SU-2023:3179-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: - CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case bsc1207534. - CVE-2023-3446: Fixed DHche...

Dependency On Vulnerable Third-Party Component

cryptography contains a Dependency On a Vulnerable Third-Party Component. The use of the bundled OpenSSL component which contains several security issues which allows an attacker to disrupt secure operations in the library. Only users installing from wheels built by the cryptography pip library a...

Slackware: Security Advisory (SSA:2023-213-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2023:3160-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12: libopenssl-devel / libopenssl1_0_0 / libopenssl1_0_0-32bit / etc (SUSE-SU-2023:3160-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:3160-1 advisory. - CVE-2023-3446: Fixed DHcheck excessive time with over sized modulus bsc1213487. Tenable has extracted the preceding description block directly from t...

Huawei EulerOS: Security Advisory for shim (EulerOS-SA-2023-2569)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] openssl

New openssl packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/openssl-1.1.1v-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues: Fix excessive time spent checking DH q...

[R1] Nessus Version 10.5.4 Fixes Multiple Vulnerabilities

R1 Nessus Version 10.5.4 Fixes Multiple Vulnerabilities Jason Schavel Wed, 08/02/2023 - 11:15 Nessus leverages third-party software to help provide underlying functionality. One of the third-party components OpenSSL was found to contain vulnerabilities, and updated versions have been made availab...

SUSE-SU-2023:3160-1 Security update for openssl

This update for openssl fixes the following issues: - CVE-2023-3446: Fixed DHcheck excessive time with over sized modulus bsc1213487...

SUSE CVE-2023-3817

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DHcheck, DHcheckex or EVPPKEYparamcheck to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been...

EulerOS Virtualization 2.10.1 : shim (EulerOS-SA-2023-2550)

According to the versions of the shim packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to...

SUSE SLES12 Security Update : compat-openssl098 (SUSE-SU-2023:3096-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3096-1 advisory. - CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out...

AlmaLinux 9 : nodejs (ALSA-2023:4331)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:4331 advisory. - The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request...

Slackware Linux 15.0 / current openssl Multiple Vulnerabilities (SSA:2023-213-01)

The version of openssl installed on the remote host is prior to 1.1.1v / 3.1.2. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-213-01 advisory. - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications tha...

SUSE: Security Advisory (SUSE-SU-2023:3093-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...