[ASA-201812-5] openssl: private key recovery

Arch Linux Security Advisory ASA-201812-5 ========================================= Severity: Low Date : 2018-12-08 CVE-ID : CVE-2018-0734 CVE-2018-0735 Package : openssl Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-792 Summary ======= The package openssl...

[ASA-201812-7] lib32-openssl-1.0: private key recovery

Arch Linux Security Advisory ASA-201812-7 ========================================= Severity: Low Date : 2018-12-08 CVE-ID : CVE-2018-0734 CVE-2018-5407 Package : lib32-openssl-1.0 Type : private key recovery Remote : Yes Link : https://security.archlinux.org/AVG-806 Summary ======= The package...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : OpenSSL vulnerabilities (USN-3840-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3840-1 advisory. Samuel Weiser discovered that OpenSSL incorrectly handled DSA signing. An attacker could possibly use this issue to perform a...

USN-3840-1: OpenSSL vulnerabilities

Samuel Weiser discovered that OpenSSL incorrectly handled DSA signing. An attacker could possibly use this issue to perform a timing side-channel attack and recover private DSA keys. CVE-2018-0734 Samuel Weiser discovered that OpenSSL incorrectly handled ECDSA signing. An attacker could possibly...

SUSE-SU-2018:4001-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. - CVE-2018-5407: Added elliptic curve scalar multiplication timing attack defenses that fixes 'PortSmash' bsc1113534. Non-security...

SUSE-SU-2018:3994-1 Security update for compat-openssl097g

This update for compat-openssl097g fixes the following issues: Security issue fixed: - CVE-2016-8610: Adjusted current fix and add missing error string bsc1110018. Non-security issue fixed: - Fixed timing vulnerability in DSA signature generation bsc1113742...

SUSE SLED12 / SLES12 Security Update : openssl-1_0_0 (SUSE-SU-2018:3989-1)

This update for openssl-100 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses bsc1113534. Add missing timing side channel patch for...

RHEL 6 : Red Hat OpenShift Enterprise 1.1.2 update (Moderate) (RHSA-2013:0638)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0638 advisory. OpenShift Enterprise is a cloud computing Platform-as-a-Service PaaS solution from Red Hat, and is designed for on-premise or private cloud...

CVE-2018-15800: Timing attack allows extraction of signing key in Bits Service | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions Bits Service release versions prior to 2.18.0 Description Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing...

SUSE-SU-2018:3989-1 Security update for openssl-1_0_0

This update for openssl-100 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses bsc1113534. - Add missing timing side channel patch...

SUSE-SU-2018:3964-1 Security update for openssl1

This update for openssl1 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses bsc1113534. - CVE-2016-8610: Adjusted current fix and...

Timing Attack

SimpleCrypto.Net is vulnerable to timing attack. A non-constant time comparison function used to compare passwords allow remote attackers to determine valid passwords by analyzing the server response time...

SUSE SLED12 / SLES12 Security Update : openssl-1_1 (SUSE-SU-2018:3945-1)

This update for openssl-11 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. CVE-2018-0735: Fixed timing vulnerability in ECDSA signature generation bsc1113651. Non-security issues fixed: Fixed infinite loop in D...

SUSE-SU-2018:3945-1 Security update for openssl-1_1

This update for openssl-11 fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation bsc1113652. - CVE-2018-0735: Fixed timing vulnerability in ECDSA signature generation bsc1113651. Non-security issues fixed: - Fixed infinite loop ...

MGASA-2018-0470 Updated openssl packages fix security vulnerabilities

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a Affected 1.1.1. Fixed in OpenSSL 1.1.0j Affected 1.1.0-1.1.0i. Fixed in OpenSSL 1.0.2q...

Updated openssl packages fix security vulnerabilities

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a Affected 1.1.1. Fixed in OpenSSL 1.1.0j Affected 1.1.0-1.1.0i. Fixed in OpenSSL 1.0.2q...

node.js -- multiple vulnerabilities

Node.js reports: Updates are now available for all active Node.js release lines. These include fixes for the vulnerabilities identified in the initial announcement. They also include upgrades of Node.js 6 and 8 to OpenSSL 1.0.2q, and upgrades of Node.js 10 and 11 to OpenSSL 1.1.0j. We recommend...

Scientific Linux Security Update : openssl on SL7.x x86_64 (20181030)

Security Fixes : - openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries CVE-2018-0495 - openssl: Malicious server can send large prime to client during DHE TLS handshake causing the client to hang CVE-2018-0732 - openssl: Handling of crafted recursive ASN.1 structures can cau...

Timing Attack

openssl is vulnerable to Timing Attack. An attacker with access to mount a local timing attack during the ECDSA signature generation is able to exploit the vulnerability in the ECC scalar mmultiplication to recover the private key...

openSUSE: Security Advisory for openssl-1_1 (openSUSE-SU-2018:3890-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...