According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Normally in OpenSSL EC groups always have a co-factor     present and this is used in side channel resistant code     paths. However, in some cases, it is possible to     construct a group using explicit parameters (instead of     using a named curve). In those cases it is possible     that such a group does not have the cofactor present.
    This can occur even where all the parameters match a     known named curve. If such a curve is used then OpenSSL     falls back to non-side channel resistant code paths     which may result in full key recovery during an ECDSA     signature operation. In order to be vulnerable an     attacker would have to have the ability to time the     creation of a large number of signatures where explicit     parameters with no co-factor present are in use by an     application using libcrypto. For the avoidance of doubt     libssl is not vulnerable because explicit parameters     are never used. Fixed in OpenSSL 1.1.1d (Affected     1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected     1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected     1.0.2-1.0.2s).(CVE-2019-1547)

  - In situations where an attacker receives automated     notification of the success or failure of a decryption     attempt an attacker, after sending a very large number     of messages to be decrypted, can recover a CMS/PKCS7     transported encryption key or decrypt any RSA encrypted     message that was encrypted with the public RSA key,     using a Bleichenbacher padding oracle attack.
    Applications are not affected if they use a certificate     together with the private RSA key to the CMS_decrypt or     PKCS7_decrypt functions to select the correct recipient     info to decrypt. Fixed in OpenSSL 1.1.1d (Affected     1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected     1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected     1.0.2-1.0.2s).(CVE-2019-1563)

  - OpenSSL has internal defaults for a directory tree     where it can find a configuration file as well as     certificates used for verification in TLS. This     directory is most commonly referred to as OPENSSLDIR,     and is configurable with the --prefix / --openssldir     configuration options. For OpenSSL versions 1.1.0 and     1.1.1, the mingw configuration targets assume that     resulting programs and libraries are installed in a     Unix-like environment and the default prefix for     program installation as well as for OPENSSLDIR should     be '/usr/local'. However, mingw programs are Windows     programs, and as such, find themselves looking at     sub-directories of 'C:/usr/local', which may be world     writable, which enables untrusted users to modify     OpenSSL's default configuration, insert CA     certificates, modify (or even replace) existing engine     modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is     used as default for OPENSSLDIR on all Unix and Windows     targets, including Visual C builds. However, some build     instructions for the diverse Windows targets on 1.0.2     encourage you to specify your own --prefix. OpenSSL     versions 1.1.1, 1.1.0 and 1.0.2 are affected by this     issue. Due to the limited scope of affected deployments     this has been assessed as low severity and therefore we     are not creating new releases at this time. Fixed in     OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in     OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in     OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).(CVE-2019-1552)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the compat-openssl10 package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The OpenSSL toolkit provides support for secure     communications between machines. This version of     OpenSSL package contains only the libraries and is     provided for compatibility with previous releases and     software that does not support compilation with     OpenSSL-1.1. Security Fix(es):OpenSSL has internal     defaults for a directory tree where it can find a     configuration file as well as certificates used for     verification in TLS. This directory is most commonly     referred to as OPENSSLDIR, and is configurable with the
    --prefix / --openssldir configuration options. For     OpenSSL versions 1.1.0 and 1.1.1, the mingw     configuration targets assume that resulting programs     and libraries are installed in a Unix-like environment     and the default prefix for program installation as well     as for OPENSSLDIR should be '/usr/local'. However,     mingw programs are Windows programs, and as such, find     themselves looking at sub-directories of     'C:/usr/local', which may be world writable, which     enables untrusted users to modify OpenSSL's default     configuration, insert CA certificates, modify (or even     replace) existing engine modules, etc. For OpenSSL     1.0.2, '/usr/local/ssl' is used as default for     OPENSSLDIR on all Unix and Windows targets, including     Visual C builds. However, some build instructions for     the diverse Windows targets on 1.0.2 encourage you to     specify your own --prefix. OpenSSL versions 1.1.1,     1.1.0 and 1.0.2 are affected by this issue. Due to the     limited scope of affected deployments this has been     assessed as low severity and therefore we are not     creating new releases at this time. Fixed in OpenSSL     1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l     (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t     (Affected 1.0.2-1.0.2s).Not found.(CVE-2019-1552)In     situations where an attacker receives automated     notification of the success or failure of a decryption     attempt an attacker, after sending a very large number     of messages to be decrypted, can recover a CMS/PKCS7     transported encryption key or decrypt any RSA encrypted     message that was encrypted with the public RSA key,     using a Bleichenbacher padding oracle attack.
    Applications are not affected if they use a certificate     together with the private RSA key to the CMS_decrypt or     PKCS7_decrypt functions to select the correct recipient     info to decrypt. Fixed in OpenSSL 1.1.1d (Affected     1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected     1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected     1.0.2-1.0.2s).(CVE-2019-1563)Normally in OpenSSL EC     groups always have a co-factor present and this is used     in side channel resistant code paths. However, in some     cases, it is possible to construct a group using     explicit parameters (instead of using a named curve).
    In those cases it is possible that such a group does     not have the cofactor present. This can occur even     where all the parameters match a known named curve. If     such a curve is used then OpenSSL falls back to     non-side channel resistant code paths which may result     in full key recovery during an ECDSA signature     operation. In order to be vulnerable an attacker would     have to have the ability to time the creation of a     large number of signatures where explicit parameters     with no co-factor present are in use by an application     using libcrypto. For the avoidance of doubt libssl is     not vulnerable because explicit parameters are never     used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
    Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed     in OpenSSL 1.0.2t (Affected     1.0.2-1.0.2s).(CVE-2019-1547)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - In situations where an attacker receives automated     notification of the success or failure of a decryption     attempt an attacker, after sending a very large number     of messages to be decrypted, can recover a CMS/PKCS7     transported encryption key or decrypt any RSA encrypted     message that was encrypted with the public RSA key,     using a Bleichenbacher padding oracle attack.
    Applications are not affected if they use a certificate     together with the private RSA key to the CMS_decrypt or     PKCS7_decrypt functions to select the correct recipient     info to decrypt. Fixed in OpenSSL 1.1.1d (Affected     1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected     1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected     1.0.2-1.0.2s).(CVE-2019-1563)

  - Normally in OpenSSL EC groups always have a co-factor     present and this is used in side channel resistant code     paths. However, in some cases, it is possible to     construct a group using explicit parameters (instead of     using a named curve). In those cases it is possible     that such a group does not have the cofactor present.
    This can occur even where all the parameters match a     known named curve. If such a curve is used then OpenSSL     falls back to non-side channel resistant code paths     which may result in full key recovery during an ECDSA     signature operation. In order to be vulnerable an     attacker would have to have the ability to time the     creation of a large number of signatures where explicit     parameters with no co-factor present are in use by an     application using libcrypto. For the avoidance of doubt     libssl is not vulnerable because explicit parameters     are never used. Fixed in OpenSSL 1.1.1d (Affected     1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected     1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected     1.0.2-1.0.2s).(CVE-2019-1547)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation.
In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
(CVE-2019-1547)

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). (CVE-2019-1563)

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).
Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). (CVE-2019-1563)

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation.
In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).
(CVE-2019-1547)

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG).
This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). (CVE-2019-1549)

According to the versions of the openssl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In situations where an attacker receives automated     notification of the success or failure of a decryption     attempt an attacker, after sending a very large number     of messages to be decrypted, can recover a CMS/PKCS7     transported encryption key or decrypt any RSA encrypted     message that was encrypted with the public RSA key,     using a Bleichenbacher padding oracle attack.
    Applications are not affected if they use a certificate     together with the private RSA key to the CMS_decrypt or     PKCS7_decrypt functions to select the correct recipient     info to decrypt. Fixed in OpenSSL 1.1.1d (Affected     1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected     1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected     1.0.2-1.0.2s).(CVE-2019-1563)

  - OpenSSL 1.1.1 introduced a rewritten random number     generator (RNG). This was intended to include     protection in the event of a fork() system call in     order to ensure that the parent and child processes did     not share the same RNG state. However this protection     was not being used in the default case. A partial     mitigation for this issue is that the output from a     high precision timer is mixed into the RNG state so the     likelihood of a parent and child process sharing state     is significantly reduced. If an application already     calls OPENSSL_init_crypto() explicitly using     OPENSSL_INIT_ATFORK then this problem does not occur at     all. Fixed in OpenSSL 1.1.1d (Affected     1.1.1-1.1.1c).(CVE-2019-1549)

  - Normally in OpenSSL EC groups always have a co-factor     present and this is used in side channel resistant code     paths. However, in some cases, it is possible to     construct a group using explicit parameters (instead of     using a named curve). In those cases it is possible     that such a group does not have the cofactor present.
    This can occur even where all the parameters match a     known named curve. If such a curve is used then OpenSSL     falls back to non-side channel resistant code paths     which may result in full key recovery during an ECDSA     signature operation. In order to be vulnerable an     attacker would have to have the ability to time the     creation of a large number of signatures where explicit     parameters with no co-factor present are in use by an     application using libcrypto. For the avoidance of doubt     libssl is not vulnerable because explicit parameters     are never used. Fixed in OpenSSL 1.1.1d (Affected     1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected     1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected     1.0.2-1.0.2s).(CVE-2019-1547)

  - OpenSSL has internal defaults for a directory tree     where it can find a configuration file as well as     certificates used for verification in TLS. This     directory is most commonly referred to as OPENSSLDIR,     and is configurable with the --prefix / --openssldir     configuration options. For OpenSSL versions 1.1.0 and     1.1.1, the mingw configuration targets assume that     resulting programs and libraries are installed in a     Unix-like environment and the default prefix for     program installation as well as for OPENSSLDIR should     be '/usr/local'. However, mingw programs are Windows     programs, and as such, find themselves looking at     sub-directories of 'C:/usr/local', which may be world     writable, which enables untrusted users to modify     OpenSSL's default configuration, insert CA     certificates, modify (or even replace) existing engine     modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is     used as default for OPENSSLDIR on all Unix and Windows     targets, including Visual C builds. However, some build     instructions for the diverse Windows targets on 1.0.2     encourage you to specify your own --prefix. OpenSSL     versions 1.1.1, 1.1.0 and 1.0.2 are affected by this     issue. Due to the limited scope of affected deployments     this has been assessed as low severity and therefore we     are not creating new releases at this time. Fixed in     OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in     OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in     OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).(CVE-2019-1552)

  - There is an overflow bug in the x64_64 Montgomery     squaring procedure used in exponentiation with 512-bit     moduli. No EC algorithms are affected. Analysis     suggests that attacks against 2-prime RSA1024, 3-prime     RSA1536, and DSA1024 as a result of this defect would     be very difficult to perform and are not believed     likely. Attacks against DH512 are considered just     feasible. However, for an attack the target would have     to re-use the DH512 private key, which is not     recommended anyway. Also applications directly using     the low level API BN_mod_exp may be affected if they     use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e-dev     (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u-dev     (Affected 1.0.2-1.0.2t).(CVE-2019-1551)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_0_0 fixes the following issues :

OpenSSL Security Advisory [10 September 2019]

  - CVE-2019-1547: Added EC_GROUP_set_generator side channel     attack avoidance. (bsc#1150003)

  - CVE-2019-1563: Fixed Bleichenbacher attack against     cms/pkcs7 encryption transported key (bsc#1150250)

In addition fixed invalid curve attacks by validating that an EC point lies on the curve (bsc#1131291).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1337 advisory.

  - openssl: side-channel weak encryption vulnerability (CVE-2019-1547)

  - openssl: information disclosure in fork() (CVE-2019-1549)

  - openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey (CVE-2019-1563)

  - httpd: memory corruption on early pushes (CVE-2019-10081)

  - httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

  - httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

  - httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

  - httpd: mod_rewrite potential open redirect (CVE-2019-10098)

  - httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openssl: doapr_outch function does not verify that certain memory allocation succeeds (CVE-2016-2842)

  - Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and     1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a     large amount of binary data. (CVE-2016-2105)

  - Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and     1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a     large amount of data. (CVE-2016-2106)

  - The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to     execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY     field in crafted serialized data, aka the negative zero issue. (CVE-2016-2108)

  - The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before     1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption)     via a short invalid encoding. (CVE-2016-2109)

  - OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might     allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly     have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c,     and t1_lib.c. (CVE-2016-2177)

  - The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure     the use of constant-time operations, which makes it easier for local users to discover a DSA private key     via a timing side-channel attack. (CVE-2016-2178)

  - The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries     associated with unused out-of-order messages, which allows remote attackers to cause a denial of service     (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c,     statem_dtls.c, statem_lib.c, and statem_srvr.c. (CVE-2016-2179)

  - The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new     epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial     of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and     ssl3_record.c. (CVE-2016-2181)

  - The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division     results, which allows remote attackers to cause a denial of service (out-of-bounds write and application     crash) or possibly have unspecified other impact via unknown vectors. (CVE-2016-2182)

  - The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to     cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c     and s3_srvr.c. (CVE-2016-6306)

  - While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte     overread. This would result in an incorrect text display of the certificate. This bug has been present     since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. (CVE-2017-3735)

  - The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel     attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation     process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in     OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o). (CVE-2018-0737)

  - Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually     exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service     attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is     considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected     1.0.2b-1.0.2n). (CVE-2018-0739)

  - Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to     timing attacks via a side-channel timing attack on 'port contention'. (CVE-2018-5407)

  - If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a     close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if     a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an     invalid MAC. If the application then behaves differently based on that in a way that is detectable to the     remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this     to be exploitable non-stitched ciphersuites must be in use. Stitched ciphersuites are optimised     implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice     even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in     OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q). (CVE-2019-1559)

  - In situations where an attacker receives automated notification of the success or failure of a decryption     attempt an attacker, after sending a very large number of messages to be decrypted, can recover a     CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the     public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a     certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the     correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL     1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). (CVE-2019-1563)

  - The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to     compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In     such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent     over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across     multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites.
    This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL     1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v). (CVE-2020-1968)

  - The X.509 GeneralName type is a generic type for representing different types of names. One of those name     types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different     instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both     GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a     possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1)     Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in     an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp     authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an     attacker can control both items being compared then that attacker could trigger a crash. For example if     the attacker can trick a client or server into checking a malicious certificate against a malicious CRL     then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a     certificate. This checking happens prior to the signatures on the certificate and CRL being verified.
    OpenSSL's s_server, s_client and verify tools have support for the -crl_download option which implements     automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an     unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of     EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will     accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue.
    Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected     1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). (CVE-2020-1971)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of Oracle Secure Global Desktop installed on the remote host is missing a security patch from the January 2020 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists in the Core (Apache Axis) component. An unauthenticated,     adjacent attacker can exploit this issue, to execute arbitrary commands. (CVE-2019-0227)

  - A cross-site scripting vulnerability exists in the Web Server (Appache HTTPD Server) component. An     unauthenticated, remote attacker can exploit this issue via causing the link on the mod_proxy error page     to be malformed and point to a page of the attacker's choice. (CVE-2019-10092)

  - A cross-site scripting vulnerability exists in faces/context/PartialViewContextImpl.java in Eclipse     (Mojarra) due to mishandling of a client window field. An unauthenticated, remote attacker can exploit     this issue, to perform unauthorized update, insert or delete access to some of Oracle Communications     Unified Inventory Management accessible data as well as to perform an unauthorized read access to a subset     of Oracle Communications Unified Inventory Management accessible data. (CVE-2019-17091)

According to the versions of the shim package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte     overread. This would result in an incorrect text display of the certificate. This bug has been present     since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. (CVE-2017-3735)

  - OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an 'error state' mechanism. The intent was that if     a fatal error occurred during a handshake then OpenSSL would move into the error state and would     immediately fail if you attempted to continue the handshake. This works as designed for the explicit     handshake functions (SSL_do_handshake(), SSL_accept() and SSL_connect()), however due to a bug it does not     work correctly if SSL_read() or SSL_write() is called directly. In that scenario, if the handshake fails     then a fatal error will be returned in the initial function call. If SSL_read()/SSL_write() is     subsequently called by the application for the same SSL object then it will succeed and the data is passed     without being decrypted/encrypted directly from the SSL/TLS record layer. In order to exploit this issue     an application bug would have to be present that resulted in a call to SSL_read()/SSL_write() being issued     after having already received a fatal error. OpenSSL version 1.0.2b-1.0.2m are affected. Fixed in OpenSSL     1.0.2n. OpenSSL 1.1.0 is not affected. (CVE-2017-3737)

  - During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very     large prime value to the client. This will cause the client to spend an unreasonably long period of time     generating a key for this prime resulting in a hang until the client has finished. This could be exploited     in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL     1.0.2p-dev (Affected 1.0.2-1.0.2o). (CVE-2018-0732)

  - The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel     attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation     process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in     OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o). (CVE-2018-0737)

  - Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually     exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service     attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is     considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected     1.0.2b-1.0.2n). (CVE-2018-0739)

  - In situations where an attacker receives automated notification of the success or failure of a decryption     attempt an attacker, after sending a very large number of messages to be decrypted, can recover a     CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the     public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a     certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the     correct recipient info to decrypt. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL     1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s). (CVE-2019-1563)

  - The X.509 GeneralName type is a generic type for representing different types of names. One of those name     types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different     instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both     GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a     possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1)     Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in     an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp     authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an     attacker can control both items being compared then that attacker could trigger a crash. For example if     the attacker can trick a client or server into checking a malicious certificate against a malicious CRL     then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a     certificate. This checking happens prior to the signatures on the certificate and CRL being verified.
    OpenSSL's s_server, s_client and verify tools have support for the '-crl_download' option which implements     automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an     unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of     EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will     accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue.
    Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected     1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w). (CVE-2020-1971)

  - Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument     in some cases where the input length is close to the maximum permissable length for an integer on the     platform. In such cases the return value from the function call will be 1 (indicating success), but the     output length value will be negative. This could cause applications to behave incorrectly or crash.
    OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to     OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out     of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should     upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i).
    Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). (CVE-2021-23840)

  - The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based     on the issuer and serial number data contained within an X509 certificate. However it fails to correctly     handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is     maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a     potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by     OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on     certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are     affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x     and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving     public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should     upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected     1.0.2-1.0.2x). (CVE-2021-23841)

  - ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a     buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings     which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not     a strict requirement, ASN.1 strings that are parsed using OpenSSL's own 'd2i' functions (and other similar     parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will     additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for     applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array     by directly setting the 'data' and 'length' fields in the ASN1_STRING array. This can also happen by using     the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to     assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for     strings that have been directly constructed. Where an application requests an ASN.1 structure to be     printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the     application without NUL terminating the 'data' field, then a read buffer overrun can occur. The same thing     can also occur during name constraints processing of certificates (for example if a certificate has been     directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the     certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the     X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an     application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL     functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack).
    It could also result in the disclosure of private memory contents (such as private keys, or sensitive     plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected     1.0.2-1.0.2y). (CVE-2021-3712)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
131617	EulerOS 2.0 SP2 : openssl (EulerOS-SA-2019-2464)	Nessus	Huawei Local Security Checks	12/4/2019	5/18/2022	medium
132815	EulerOS Virtualization for ARM 64 3.0.5.0 : compat-openssl10 (EulerOS-SA-2020-1061)	Nessus	Huawei Local Security Checks	1/13/2020	5/18/2022	medium
134740	EulerOS Virtualization 3.0.2.2 : openssl (EulerOS-SA-2020-1274)	Nessus	Huawei Local Security Checks	3/20/2020	5/18/2022	medium
134897	Amazon Linux 2 : openssl (ALAS-2020-1406)	Nessus	Amazon Linux Local Security Checks	3/26/2020	5/18/2022	medium
138622	Amazon Linux 2 : openssl11 (ALAS-2020-1456)	Nessus	Amazon Linux Local Security Checks	7/20/2020	3/1/2024	medium
132817	EulerOS Virtualization for ARM 64 3.0.5.0 : openssl (EulerOS-SA-2020-1063)	Nessus	Huawei Local Security Checks	1/13/2020	4/1/2024	medium
129670	openSUSE Security Update : openssl-1_0_0 (openSUSE-2019-2269)	Nessus	SuSE Local Security Checks	10/7/2019	4/19/2024	medium
135235	RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 (RHSA-2020:1337)	Nessus	Red Hat Local Security Checks	4/6/2020	4/28/2024	critical
195570	RHEL 5 : openssl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical
133042	Oracle Secure Global Desktop Multiple Vulnerabilities (January 2020 CPU)	Nessus	Misc.	1/17/2020	12/5/2022	high
155531	EulerOS Virtualization 2.9.1 : shim (EulerOS-SA-2021-2758)	Nessus	Huawei Local Security Checks	11/17/2021	11/23/2023	high

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

critical

critical

high

high