This update for gnutls fixes the following security issues :

  - GnuTLS could have crashed when processing maliciously     crafted OpenPGP certificates (GNUTLS-SA-2017-2,     bsc#1018832, CVE-2017-5335, CVE-2017-5337,     CVE-2017-5336)

  - GnuTLS could have falsely accepted certificates when     using OCSP (GNUTLS-SA-2016-3, bsc#999646, CVE-2016-7444)

  - GnuTLS could have suffered from 100% CPU load DoS     attacks by using SSL alert packets during the handshake     (bsc#1005879, CVE-2016-8610)

This update was imported from the SUSE:SLE-12:Update update project.

This update for openssl fixes the following issues :

CVE-2018-0732: Reject excessively large primes in DH key generation (bsc#1097158)

CVE-2018-0734: Timing vulnerability in DSA signature generation (bsc#1113652)

CVE-2018-0737: Cache timing vulnerability in RSA Key Generation (bsc#1089039)

CVE-2018-5407: Elliptic curve scalar multiplication timing attack defenses (fixes 'PortSmash') (bsc#1113534)

CVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown (bsc#1127080)

Fix One&Done side-channel attack on RSA (bsc#1104789)

Reject invalid EC point coordinates (bsc#1131291)

The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS Implementations (bsc#1117951)

Add missing error string to CVE-2016-8610 fix (bsc#1110018#c9)

blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)

Non security fixes: correct the error detection in the fips patch (bsc#1106197)

Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update is now available for Red Hat JBoss Core Services on RHEL 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.

This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304)

* It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack.
(CVE-2016-0736)

* It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication. (CVE-2016-2161)

* A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.
(CVE-2016-7056)

* A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610)

* It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)

* A vulnerability was found in httpd's handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server's available memory, causing httpd to crash.
(CVE-2016-8740)

Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304.

According to its banner, the version of OpenSSL on the remote host is version 1.1.0 prior to 1.1.0b and is affected by multiple vulnerabilities :

 - A flaw exists in the 'read_state_machine()' function of 'ssl/statem/statem.c'.  The issue is triggered when handling messages larger than ~ 16k.  With a specially crafted message, a remote attacker can trigger a use-after-free leading to a denial of service or potentially remote code execution. (CVE-2016-6309)
 - A flaw exists that is triggered when handling many consecutive 'SSL3_AL_WARNING' undefined alerts.  By continuously sending warning alerts, a remote attacker can cause a process linked against the library to exhaust available CPU resources and potentially stop responding. (CVE-2016-8610)

According to its banner, the version of OpenSSL on the remote host is 1.0.2 prior to 1.0.2j and is affected by multiple DoS vulnerabilities :

 - A flaw exists in the CRL functionality that is triggered when handling a certificate revocation list (CRL).  With a specially crafted CRL, a context-dependent attacker can cause the service to crash due to a NULL pointer being dereferenced. (CVE-2016-7052)
 - A flaw exists that is triggered when handling many consecutive 'SSL3_AL_WARNING' undefined alerts.  By continuously sending warning alerts, a remote attacker can cause a process linked against the library to exhaust available CPU resources and potentially stop responding. (CVE-2016-8610)

ID	Name	Product	Family	Published	Updated	Severity
97004	openSUSE Security Update : gnutls (openSUSE-2017-207)	Nessus	SuSE Local Security Checks	2/6/2017	1/19/2021	critical
126046	SUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)	Nessus	SuSE Local Security Checks	6/19/2019	12/5/2022	medium
117315	RHEL 7 : JBoss Core Services (RHSA-2017:1413)	Nessus	Red Hat Local Security Checks	9/6/2018	10/24/2019	high
9628	OpenSSL 1.1.0 < 1.1.0b Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	10/6/2016	3/6/2019	critical
9627	OpenSSL 1.0.2 < 1.0.2j Multiple DoS	Nessus Network Monitor	Web Servers	10/6/2016	3/6/2019	medium

Detections

Analytics

Plugins Search

critical

medium

high

critical

medium