| Description: | Summary:
The remote host is missing an update for the 'compat-openssl097g' package(s) announced via the SUSE-SU-2015:0182-1 advisory.
Vulnerability Insight:
OpenSSL (compat-openssl097g) has been updated to fix various security issues.
More information can be found in the openssl advisory:
[link moved to references] .
The following issues have been fixed:
*
CVE-2014-3570: Bignum squaring (BN_sqr) may have produced incorrect results on some platforms, including x86_64. (bsc#912296)
*
CVE-2014-3572: Don't accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted. (bsc#912015)
*
CVE-2014-8275: Fixed various certificate fingerprint issues.
(bsc#912018)
*
CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites.
(bsc#912014)
*
CVE-2015-0205: A fix was added to prevent use of DH client certificates without sending certificate verify message. Note that compat-openssl097g is not affected by this problem, a fix was however applied to the sources. (bsc#912293)
Security Issues:
* CVE-2014-3570
* CVE-2014-3572
* CVE-2014-8275
* CVE-2015-0204
* CVE-2015-0205
Affected Software/OS:
'compat-openssl097g' package(s) on SUSE Linux Enterprise Desktop 11-SP3, SUSE Linux Enterprise Server 10-SP4.
Solution:
Please install the updated package(s).
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:P/A:N
|
