| Description: | Summary:
The remote host is missing an update for the 'OpenSSL' package(s) announced via the SUSE-SU-2015:0172-1 advisory.
Vulnerability Insight:
OpenSSL has been updated to fix various security issues.
More information can be found in the OpenSSL advisory:
[link moved to references] .
The following issues have been fixed:
*
CVE-2014-3570: Bignum squaring (BN_sqr) may have produced incorrect results on some platforms, including x86_64. (bsc#912296)
*
CVE-2014-3571: Fixed crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record. (bsc#912294)
*
CVE-2014-3572: Don't accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted. (bsc#912015)
*
CVE-2014-8275: Fixed various certificate fingerprint issues.
(bsc#912018)
*
CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites.
(bsc#912014)
*
CVE-2015-0205: A fix was added to prevent use of DH client certificates without sending certificate verify message. Although the OpenSSL library from SLES 10 is not affected by this problem, a fix has been applied to the sources. (bsc#912293)
*
CVE-2015-0206: A memory leak was fixed in dtls1_buffer_record.
(bsc#912292)
Security Issues:
* CVE-2014-8275
* CVE-2014-3571
* CVE-2015-0204
* CVE-2014-3572
* CVE-2014-3570
* CVE-2015-0205
Affected Software/OS:
'OpenSSL' package(s) on SUSE Linux Enterprise Server 10-SP4, SUSE Manager 1.7, SUSE Studio Onsite 1.3.
Solution:
Please install the updated package(s).
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
