Several local side channel attacks and a denial of service via large Diffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets Layer toolkit.

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 7.1.4. It is, therefore, affected by multiple vulnerabilities:

  - Tenable Nessus contains a flaw in the bundled third-party     component OpenSSL library's key handling during a TLS     handshake that causes a denial of service vulnerability     due to key handling during a TLS handshake.     (CVE-2018-0732)

  - Tenable Nessus contains a flaw in the bundled third-party     component OpenSSL library's DSA signature algorithm that     renders it vulnerable to a timing side channel attack.
    An attacker could leverage this vulnerability to recover     the private key. (CVE-2018-0734)

  - Tenable Nessus contains a flaw in the bundled third-party     component OpenSSL library's RSA Key generation algorithm     that allows a cache timing side channel attack to recover     the private key. (CVE-2018-0737)

  - Tenable Nessus contains a flaw in the bundled third-party     component OpenSSL library's Simultaneous Multithreading     (SMT) architectures which render it vulnerable to     side-channel leakage. This issue is known as 'PortSmash'.     An attacker could possibly use this issue to perform a     timing side-channel attack and recover private keys.     (CVE-2018-5407)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - openssl: ROHNP - Key Extraction Side Channel in     Multiple Crypto Libraries (CVE-2018-0495)

  - openssl: Malicious server can send large prime to     client during DH(E) TLS handshake causing the client to     hang (CVE-2018-0732)

  - openssl: Handling of crafted recursive ASN.1 structures     can cause a stack overflow and resulting denial of     service (CVE-2018-0739)

  - openssl: Malformed X.509 IPAdressFamily could cause OOB     read (CVE-2017-3735)

  - openssl: RSA key generation cache timing vulnerability     in crypto/rsa/rsa_gen.c allows attackers to recover     private keys (CVE-2018-0737)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_0_0 fixes the following issues :

  - CVE-2018-0732: During key agreement in a TLS handshake     using a DH(E) based ciphersuite a malicious server could     have sent a very large prime value to the client. This     caused the client to spend an unreasonably long period     of time generating a key for this prime resulting in a     hang until the client has finished. This could be     exploited in a Denial Of Service attack (bsc#1097158).

  - Blinding enhancements for ECDSA and DSA (bsc#1097624,     bsc#1098592)

This update was imported from the SUSE:SLE-15:Update update project.

This update for openssl-1_0_0 to 1.0.2p fixes the following issues :

These security issues were fixed :

  - Prevent One&Done side-channel attack on RSA that allowed     physically near attackers to use EM emanations to     recover information (bsc#1104789)

  - CVE-2018-0737: The RSA Key generation algorithm has been     shown to be vulnerable to a cache timing side channel     attack. An attacker with sufficient access to mount     cache timing attacks during the RSA key generation     process could have recovered the private key     (bsc#1089039)

  - CVE-2018-0732: During key agreement in a TLS handshake     using a DH(E) based ciphersuite a malicious server could     have sent a very large prime value to the client. This     caused the client to spend an unreasonably long period     of time generating a key for this prime resulting in a     hang until the client has finished. This could be     exploited in a Denial Of Service attack (bsc#1097158)

  - Make problematic ECDSA sign addition length-invariant

  - Add blinding to ECDSA and DSA signatures to protect     against side channel attacks

This non-security issue was fixed :

  - Add openssl(cli) Provide so the packages that require     the openssl binary can require this instead of the new     openssl meta package (bsc#1101470)

This update was imported from the SUSE:SLE-15:Update update project.

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a     memory-cache side-channel attack on ECDSA signatures     that can be mitigated through the use of blinding     during the signing process in the _gcry_ecc_ecdsa_sign     function in cipher/ecc-ecdsa.c, aka the Return Of the     Hidden Number Problem or ROHNP. To discover an ECDSA     key, the attacker needs access to either the local     machine or a different virtual machine on the same     physical host.i1/4^CVE-2018-0495i1/4%0

  - During key agreement in a TLS handshake using a DH(E)     based ciphersuite a malicious server can send a very     large prime value to the client. This will cause the     client to spend an unreasonably long period of time     generating a key for this prime resulting in a hang     until the client has finished. This could be exploited     in a Denial Of Service attack. Fixed in OpenSSL     1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL     1.0.2p-dev (Affected 1.0.2-1.0.2o).i1/4^CVE-2018-0732i1/4%0

  - Constructed ASN.1 types with a recursive definition     (such as can be found in PKCS7) could eventually exceed     the stack given malicious input with excessive     recursion. This could result in a Denial Of Service     attack. There are no such structures used within     SSL/TLS that come from untrusted sources so this is     considered safe. Fixed in OpenSSL 1.1.0h (Affected     1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected     1.0.2b-1.0.2n).i1/4^CVE-2018-0739i1/4%0

  - While parsing an IPAddressFamily extension in an X.509     certificate, it is possible to do a one-byte overread.
    This would result in an incorrect text display of the     certificate. This bug has been present since 2006 and     is present in all versions of OpenSSL before 1.0.2m and     1.1.0g.i1/4^CVE-2017-3735i1/4%0

  - OpenSSL RSA key generation was found to be vulnerable     to cache side-channel attacks. An attacker with     sufficient access to mount cache timing attacks during     the RSA key generation process could recover parts of     the private key.i1/4^CVE-2018-0737i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the compat-openssl10 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - During key agreement in a TLS handshake using a DH(E)     based ciphersuite a malicious server can send a very     large prime value to the client. This will cause the     client to spend an unreasonably long period of time     generating a key for this prime resulting in a hang     until the client has finished. This could be exploited     in a Denial Of Service attack.(CVE-2017-0732)

  - OpenSSL RSA key generation was found to be vulnerable     to cache side-channel attacks. An attacker with     sufficient access to mount cache timing attacks during     the RSA key generation process could recover parts of     the private key.(CVE-2018-0737)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openssl packages installed that are affected by multiple vulnerabilities:

  - While parsing an IPAddressFamily extension in an X.509     certificate, it is possible to do a one-byte overread.
    This would result in an incorrect text display of the     certificate. This bug has been present since 2006 and is     present in all versions of OpenSSL before 1.0.2m and     1.1.0g. (CVE-2017-3735)

  - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a     memory-cache side-channel attack on ECDSA signatures     that can be mitigated through the use of blinding during     the signing process in the _gcry_ecc_ecdsa_sign function     in cipher/ecc-ecdsa.c, aka the Return Of the Hidden     Number Problem or ROHNP. To discover an ECDSA key, the     attacker needs access to either the local machine or a     different virtual machine on the same physical host.
    (CVE-2018-0495)

  - OpenSSL RSA key generation was found to be vulnerable to     cache side-channel attacks. An attacker with sufficient     access to mount cache timing attacks during the RSA key     generation process could recover parts of the private     key. (CVE-2018-0737)

  - Constructed ASN.1 types with a recursive definition     (such as can be found in PKCS7) could eventually exceed     the stack given malicious input with excessive     recursion. This could result in a Denial Of Service     attack. There are no such structures used within SSL/TLS     that come from untrusted sources so this is considered     safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g).
    Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
    (CVE-2018-0739)

  - A microprocessor side-channel vulnerability was found on     SMT (e.g, Hyper-Threading) architectures. An attacker     running a malicious process on the same core of the     processor as the victim process can extract certain     secret information. (CVE-2018-5407)

  - During key agreement in a TLS handshake using a DH(E)     based ciphersuite a malicious server can send a very     large prime value to the client. This will cause the     client to spend an unreasonably long period of time     generating a key for this prime resulting in a hang     until the client has finished. This could be exploited     in a Denial Of Service attack. Fixed in OpenSSL     1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL     1.0.2p-dev (Affected 1.0.2-1.0.2o). (CVE-2018-0732)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Patch for CVE-2018-0737, CVE-2018-0732, CVE-2018-0734, CVE-2019-1552, CVE-2019-1559.

https://www.openssl.org/news/vulnerabilities.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of AOS installed on the remote host is prior to 6.7.1.5. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-6.7.1.5 advisory.

  - There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and     1.1.0 before 1.1.0g. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as     a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH     are considered just feasible (although very difficult) because most of the work necessary to deduce     information about a private key may be performed offline. The amount of resources required for such an     attack would be very significant and likely only accessible to a limited number of attackers. An attacker     would additionally need online access to an unpatched system using the target private key in a scenario     with persistent DH parameters and a private key that is shared between multiple clients. This only affects     processors that support the BMI1, BMI2 and ADX extensions like Intel Broadwell (5th generation) and later     or AMD Ryzen. (CVE-2017-3736)

  - While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte     overread. This would result in an incorrect text display of the certificate. This bug has been present     since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. (CVE-2017-3735)

  - There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with     1024-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against RSA and DSA as a     result of this defect would be very difficult to perform and are not believed likely. Attacks against     DH1024 are considered just feasible, because most of the work necessary to deduce information about a     private key may be performed offline. The amount of resources required for such an attack would be     significant. However, for an attack on TLS to be meaningful, the server would have to share the DH1024     private key among multiple clients, which is no longer an option since CVE-2016-0701. This only affects     processors that support the AVX2 but not ADX extensions like Intel Haswell (4th generation). Note: The     impact from this issue is similar to CVE-2017-3736, CVE-2017-3732 and CVE-2015-3193. OpenSSL version     1.0.2-1.0.2m and 1.1.0-1.1.0g are affected. Fixed in OpenSSL 1.0.2n. Due to the low severity of this issue     we are not issuing a new release of OpenSSL 1.1.0 at this time. The fix will be included in OpenSSL 1.1.0h     when it becomes available. The fix is also available in commit e502cc86d in the OpenSSL git repository.
    (CVE-2017-3738)

  - Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with     Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress     refactoring that exposed a potential denial of service on Windows if a web application opened a stream for     an uploaded file but failed to close the stream. The file would never be deleted from disk creating the     possibility of an eventual denial of service due to the disk being full. Users are recommended to upgrade     to version 9.0.81 onwards or 8.5.94 onwards, which fixes the issue. (CVE-2023-42794)

  - Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat     from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from     8.5.0 through 8.5.93, an error could cause Tomcat to skip some parts of the recycling process leading to     information leaking from the current request/response to the next. Older, EOL versions may also be     affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards     or 8.5.94 onwards, which fixes the issue. (CVE-2023-42795)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
119792	Debian DSA-4355-1 : openssl1.0 - security update	Nessus	Debian Local Security Checks	12/20/2018	3/21/2025	medium
120198	Tenable Nessus < 7.1.4 Multiple Vulnerabilities (TNS-2018-17)	Nessus	Misc.	1/2/2019	3/21/2025	medium
120997	EulerOS 2.0 SP5 : openssl (EulerOS-SA-2019-1009)	Nessus	Huawei Local Security Checks	1/8/2019	3/21/2025	medium
123235	openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-549)	Nessus	SuSE Local Security Checks	3/27/2019	6/11/2024	high
123323	openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-753)	Nessus	SuSE Local Security Checks	3/27/2019	3/12/2025	medium
123887	EulerOS Virtualization 2.5.4 : openssl (EulerOS-SA-2019-1201)	Nessus	Huawei Local Security Checks	4/9/2019	3/11/2025	medium
126270	EulerOS 2.0 SP8 : compat-openssl10 (EulerOS-SA-2019-1643)	Nessus	Huawei Local Security Checks	6/27/2019	2/25/2025	medium
127262	NewStart CGSL CORE 5.04 / MAIN 5.04 : openssl Multiple Vulnerabilities (NS-SA-2019-0065)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	2/25/2025	medium
129653	Fedora 31 : 1:compat-openssl10 (2019-db06efdea1)	Nessus	Fedora Local Security Checks	10/7/2019	2/24/2025	high
189370	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-6.7.1.5)	Nessus	Misc.	1/23/2024	9/1/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

high

medium

medium

medium

medium

high

medium