GLSA-201903-10 : OpenSSL: Multiple vulnerabilities
Medium Nessus Plugin ID 122832
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-201903-10 (OpenSSL: Multiple vulnerabilities)
Multiple vulnerabilities have been discovered in OpenSSL. Please review the CVE identifiers referenced below for details.
A remote attacker to obtain sensitive information, caused by the failure to immediately close the TCP connection after the hosts encounter a zero-length record with valid padding.
A local attacker could run a malicious process next to legitimate processes using the architecture’s parallel thread running capabilities to leak encrypted data from the CPU’s internal processes.
There is no known workaround at this time.
SolutionAll OpenSSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=dev-libs/openssl-1.0.2r'