openSUSE Security Update : apache2 (openSUSE-2015-635) (Logjam)

low Nessus Plugin ID 86285


The remote openSUSE host is missing a security update.


Apache2 was updated to fix security issues.

- CVE-2015-3185: The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x did not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior. [bnc#938723]

- CVE-2015-3183: The chunked transfer coding implementation in the Apache HTTP Server did not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c. [bnc#938728]

On openSUSE 13.1 :

- CVE-2015-4000: Fix Logjam vulnerability: change the default SSLCipherSuite cipherstring to disable export cipher suites and deploy Ephemeral Elliptic-Curve Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to generate a strong and unique Diffie Hellman Group and append it to the server certificate file [bnc#931723].


Update the affected apache2 packages.

See Also

Plugin Details

Severity: Low

ID: 86285

File Name: openSUSE-2015-635.nasl

Version: 2.10

Type: local

Agent: unix

Published: 10/6/2015

Updated: 12/5/2022

Supported Sensors: Frictionless Assessment Azure, Nessus Agent, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus

Risk Information


Risk Factor: Medium

Score: 4.5


Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N


Risk Factor: Low

Base Score: 3.7

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:apache2, p-cpe:/a:novell:opensuse:apache2-debuginfo, p-cpe:/a:novell:opensuse:apache2-debugsource, p-cpe:/a:novell:opensuse:apache2-devel, p-cpe:/a:novell:opensuse:apache2-event, p-cpe:/a:novell:opensuse:apache2-event-debuginfo, p-cpe:/a:novell:opensuse:apache2-example-pages, p-cpe:/a:novell:opensuse:apache2-prefork, p-cpe:/a:novell:opensuse:apache2-prefork-debuginfo, p-cpe:/a:novell:opensuse:apache2-utils, p-cpe:/a:novell:opensuse:apache2-utils-debuginfo, p-cpe:/a:novell:opensuse:apache2-worker, p-cpe:/a:novell:opensuse:apache2-worker-debuginfo, cpe:/o:novell:opensuse:13.1, cpe:/o:novell:opensuse:13.2

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 9/25/2015

Reference Information

CVE: CVE-2015-3183, CVE-2015-3185, CVE-2015-4000