| Description: | Summary:
The remote host is missing an update for the 'openssl' package(s) announced via the SUSE-SU-2019:1553-1 advisory.
Vulnerability Insight:
This update for openssl fixes the following issues:
- CVE-2018-0732: Reject excessively large primes in DH key generation (bsc#1097158)
- CVE-2018-0734: Timing vulnerability in DSA signature generation (bsc#1113652)
- CVE-2018-0737: Cache timing vulnerability in RSA Key Generation (bsc#1089039)
- CVE-2018-5407: Elliptic curve scalar multiplication timing attack defenses (fixes 'PortSmash') (bsc#1113534)
- CVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown (bsc#1127080)
- Fix One&Done side-channel attack on RSA (bsc#1104789)
- Reject invalid EC point coordinates (bsc#1131291)
- The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS Implementations (bsc#1117951)
- Add missing error string to CVE-2016-8610 fix (bsc#1110018#c9)
- blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)
Non security fixes:
- correct the error detection in the fips patch (bsc#1106197)
- Add openssl(cli) Provide so the packages that require the openssl
binary can require this instead of the new openssl meta package
(bsc#1101470)
Affected Software/OS:
'openssl' package(s) on SUSE Linux Enterprise Server 12.
Solution:
Please install the updated package(s).
CVSS Score:
5.0
CVSS Vector:
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
