The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that "(appropriately) short exponents" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain     calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that     (appropriately) short exponents can be used when there are adequate subgroup constraints, and these     short exponents can lead to less expensive calculations than for long exponents. This issue is different     from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation     about numbers that are not public keys. The specific situations in which calculation expense would     constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE     implementation details. In general, there might be an availability concern because of server-side resource     consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to     exploit this vulnerability and CVE-2002-20001 together. (CVE-2022-40735)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6854-1 advisory.

    It was discovered that OpenSSL failed to choose an appropriately short private key size when computing     shared-secrets in the Diffie-Hellman Key Agreement Protocol. A remote attacker could possibly use this     issue to cause OpenSSL to consume resources, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2470-1 advisory.

    - Update to version 3.0.8 (bsc#1207541).

    - CVE-2022-40735: Fixed remote trigger of expensive server-side DHE modular-exponentiation with long     exponents in Diffie-Hellman Key Agreement Protocol (bsc#1205476).
    - CVE-2023-1255: Fixed input buffer over-read in AES-XTS implementation on 64 bit ARM (bsc#1210714).
    - CVE-2023-2650: Fixed possible DoS translating ASN.1 object identifiers (bsc#1211430).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.4 / 17.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the K83120834 advisory.

    The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary     numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation     calculations, aka a D(HE)ater attack. The client needs very little CPU resources and network bandwidth.
    The attack may be more disruptive in cases where a client can require a server to select its largest     supported key size. The basic attack scenario is that the client must claim that it can only communicate     with DHE, and the server must be configured to allow DHE.(CVE-2002-20001)The Diffie-Hellman Key Agreement     Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive,     because the 1996 van Oorschot and Wiener paper found that (appropriately) short exponents can be used     when there are adequate subgroup constraints, and these short exponents can lead to less expensive     calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on     an observation about exponent size, rather than an observation about numbers that are not public keys. The     specific situations in which calculation expense would constitute a server-side vulnerability depend on     the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an     availability concern because of server-side resource consumption from DHE modular-exponentiation     calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001     together. (CVE-2022-40735)

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
262538	Linux Distros Unpatched Vulnerability : CVE-2022-40735	Nessus	Misc.	high
201069	Ubuntu 22.04 LTS : OpenSSL vulnerability (USN-6854-1)	Nessus	Ubuntu Local Security Checks	high
177062	openSUSE 15: libopenssl-3-devel / libopenssl-3-devel-32bit / libopenssl3 / etc (SUSE-SU-2023:2470-1)	Nessus	SuSE Local Security Checks	high
161373	F5 Networks BIG-IP : Diffie-Hellman key agreement protocol weaknesses (K83120834)	Nessus	F5 Networks Local Security Checks	high

Detections

Analytics

CVE-2022-40735

high

Tenable Plugins

high

high

high

high