| Description: | Summary:
The remote host is missing an update for the 'OpenSSL' package(s) announced via the SUSE-SU-2015:0172-2 advisory.
Vulnerability Insight:
OpenSSL has been updated to fix various security issues.
More information can be found in the OpenSSL advisory:
[link moved to references] .
The following issues have been fixed:
*
CVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect results
on some platforms, including x86_64. (bsc#912296)
*
CVE-2014-3571: Fix crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record. (bsc#912294)
*
CVE-2014-3572: Don't accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted. (bsc#912015)
*
CVE-2014-8275: Fix various certificate fingerprint issues.
(bsc#912018)
*
CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites.
(bsc#912014)
*
CVE-2015-0205: OpenSSL 0.9.8j is NOT vulnerable to CVE-2015-0205 as it doesn't support DH certificates and this typo prohibits skipping
of certificate verify message for sign only certificates anyway.
(bsc#912293)
Security Issues:
* CVE-2014-8275
* CVE-2014-3571
* CVE-2015-0204
* CVE-2014-3572
* CVE-2014-3570
* CVE-2015-0205
Affected Software/OS:
'OpenSSL' package(s) on SUSE Linux Enterprise Desktop 11-SP3, SUSE Linux Enterprise Server 11-SP1, SUSE Linux Enterprise Server 11-SP2, SUSE Linux Enterprise Server 11-SP3, SUSE Linux Enterprise Software Development Kit 11-SP3.
Solution:
Please install the updated package(s).
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
