According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - openssl: ROHNP - Key Extraction Side Channel in     Multiple Crypto Libraries (CVE-2018-0495)

  - openssl: Malicious server can send large prime to     client during DH(E) TLS handshake causing the client to     hang (CVE-2018-0732)

  - openssl: Handling of crafted recursive ASN.1 structures     can cause a stack overflow and resulting denial of     service (CVE-2018-0739)

  - openssl: Malformed X.509 IPAdressFamily could cause OOB     read (CVE-2017-3735)

  - openssl: RSA key generation cache timing vulnerability     in crypto/rsa/rsa_gen.c allows attackers to recover     private keys (CVE-2018-0737)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nodejs4 fixes the following issues :

Security issues fixed :

CVE-2018-12115: Fixed an out-of-bounds memory write in Buffer that could be used to write to memory outside of a Buffer's memory space buffer (bsc#1105019)

Upgrade to OpenSSL 1.0.2p, which fixed :

  - CVE-2018-0732: Client denial-of-service due to large DH     parameter (bsc#1097158)

  - ECDSA key extraction via local side-channel

Other changes made: Recommend same major version npm package (bsc#1097748)

Use absolute paths in executable shebang lines

Fix building with ICU61.1 (bsc#1091764)

Install license with %license, not %doc (bsc#1082318)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_1 to 1.1.0i fixes the following issues :

These security issues were fixed :

CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158)

Make problematic ECDSA sign addition length-invariant

Add blinding to ECDSA and DSA signatures to protect against side channel attacks

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.1.0i version from upstream fixing minor security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities : 

  - Enterprise Manager Base Platform Agent Next Gen (Jython)     component of Oracle Enterprise Manager Products Suite is easily     exploited and can allow an unauthenticated attacker the ability     to takeover the Enterprise Manager Base Platform. (CVE-2016-4000)

  - Enterprise Manager Base Platform Discovery Framework (OpenSSL)     component of Oracle Enterprise Manager Products Suite is easily     exploited and can allow an unauthenticated attacker the ability     to cause a frequent crash (DoS) of the Enterprise Manager Base     Platform. (CVE-2018-0732)

  - Enterprise Manager Ops Center Networking (OpenSSL) component of     Oracle Enterprise Manager Products Suite is easily exploited     and can allow an unauthenticated attacker the ability to cause a     frequent crash (DoS) of the Enterprise Manager Ops Center     Platform. (CVE-2018-0732)

  - Oracle Application Testing Suite Load Testing for Web Apps     (Spring Framework) component of Oracle Enterprise Manager     Products Suite is easily exploited and can allow an     unauthenticated attacker the ability to takeover the Enterprise     Manager Base Platform. (CVE-2018-1258)

  - Enterprise Manager Base Platform EM Console component is easily     exploited by an unauthenticated attacker. Successful attacks     can result in unauthorized update, insert, or delete access.     (CVE-2018-3303)

  - Oracle Application Testing Suite Load Testing for Web Apps     component is easily exploited by an unauthenticated attacker.     Successful attacks can result in unauthorized update, insert, or     delete access and a partial denial of service. (CVE-2018-3304)

  - Oracle Application Testing Suite Load Testing for Web Apps     component is easily exploited by an unauthenticated attacker.     Successful attacks can result in unauthorized update, insert, or     delete access and a partial denial of service. (CVE-2018-3305)

  - Enterprise Manager for Virtualization Plug-In Lifecycle     (jackson-databind) component of Oracle Enterprise Manager     allows an unauthenticated attacker the ability to takeover      Enterprise Manager for Virtualization. (CVE-2018-12023)

  - Enterprise Manager for Virtualization Plug-In Lifecycle     (jackson-databind) component of Oracle Enterprise Manager     allows an unauthenticated attacker the ability to takeover      Enterprise Manager for Virtualization. (CVE-2018-14718)

  - Enterprise Manager Ops Center Networking (cURL) component of     Oracle Enterprise Manager allows an unauthenticated attacker the     ability to takeover Enterprise Manager Ops Center.     (CVE-2018-1000300)

An update of the openssl package has been released.

This update for nodejs8 to version 8.11.4 fixes the following issues :

Security issues fixed :

  - CVE-2018-12115: Fixed an out-of-bounds memory write in     Buffer that could be used to write to memory outside of     a Buffer's memory space buffer (bsc#1105019)

  - Upgrade to OpenSSL 1.0.2p, which fixed :

  - CVE-2018-0732: Client denial-of-service due to large DH     parameter (bsc#1097158)

  - ECDSA key extraction via local side-channel

Other changes made :

  - Recommend same major version npm package (bsc#1097748)

  - Fix parallel/test-tls-passphrase.js test to continue to     function with older versions of OpenSSL library.

This update was imported from the SUSE:SLE-15:Update update project.

The version of Palo Alto Networks PAN-OS running on the remote host is 6.1.x including 6.1.20 or 7.1.x prior to 7.1.21 or 8.0.x prior to 8.0.14 or 8.1.x prior to 8.1.4. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service (DoS) vulnerability that exists in OpenSSL    due to failure of handling the exception conditions during the TLS    handshake. An authenticated, remote attacker can exploit this issue    , via malicious server to send large prime value to the client to    spend unreasonably long time for generating the key for this prime    resulting hang until the client finished. (CVE-2018-0732)

  - An information disclosure vulnerability that exists in OpenSSL    RSA key generation algorithm due to a cache timing side channel    attack. An authenticated, local attacker can exploit this issue,    via cache timing attacks during the RSA key generation process,    to recover the private key. (CVE-2018-0737)

  - A denial of service (DoS) vulnerability that exists in OpenSSL due    to a constructed ASN.1 types with a recursive definition. An    unauthenticated, remote attacker can exploit this issue, via    creating malicious input with excessive recursion, to cause the    Denial Of Service attack. (CVE-2018-0739)

The self-reported SGOS version installed on the remote Symantec ProxySG device is 6.5.x, 6.6.x or 6.7 prior to 6.7.4.1. It is, therefore, affected by OpenSSL denial of service vulnerability.

Patch for CVE-2018-0737, CVE-2018-0732, CVE-2018-0734, CVE-2019-1552, CVE-2019-1559.

https://www.openssl.org/news/vulnerabilities.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
119520	EulerOS 2.0 SP3 : openssl (EulerOS-SA-2018-1392)	Nessus	Huawei Local Security Checks	12/10/2018	3/21/2025	medium
120093	SUSE SLES12 Security Update : nodejs4 (SUSE-SU-2018:2647-1)	Nessus	SuSE Local Security Checks	1/2/2019	7/10/2024	high
120114	SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2018:2956-1)	Nessus	SuSE Local Security Checks	1/2/2019	7/10/2024	high
120424	Fedora 28 : 1:openssl (2018-520e4c5b4e)	Nessus	Fedora Local Security Checks	1/3/2019	3/21/2025	medium
121257	Oracle Application Testing Suite Multiple Vulnerabilities (Jan 2019 CPU)	Nessus	Misc.	1/21/2019	11/4/2024	critical
121875	Photon OS 1.0: Openssl PHSA-2018-1.0-0175	Nessus	PhotonOS Local Security Checks	2/7/2019	5/23/2022	high
123312	openSUSE Security Update : nodejs8 (openSUSE-2019-718)	Nessus	SuSE Local Security Checks	3/27/2019	6/11/2024	high
123512	Palo Alto Networks PAN-OS 6.1.x <= 6.1.20 / 7.1.x < 7.1.21 / 8.0.x < 8.0.14 / 8.1.x < 8.1.4 Multiple Vulnerabilities (PAN-SA-2018-0015)	Nessus	Palo Alto Local Security Checks	3/29/2019	3/12/2025	medium
128303	Symantec ProxySG 6.5 / 6.6 / 6.7 < 6.7.4.1 OpenSSL Denial of Service Vulnerability (SA1462)	Nessus	Firewalls	8/29/2019	1/7/2020	high
129368	Fedora 29 : 1:compat-openssl10 (2019-9a0a7c0986)	Nessus	Fedora Local Security Checks	9/26/2019	2/24/2025	high

Detections

Analytics

Plugins Search

medium

high

high

medium

critical

high

high

medium

high

high