ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j).

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3700 advisory.

    [1.1.1c-2]
    - do not try to use EC groups disallowed in FIPS mode       in TLS
    - fix Valgrind regression with constant-time code

    [1.1.1c-1]
    - update to the 1.1.1c release

    [1.1.1b-6]
    - adjust the default cert pbe algorithm for pkcs12 -export       in the FIPS mode

    [1.1.1b-5]
    - Fix small regressions related to the rebase

    [1.1.1b-3]
    - FIPS compliance fixes

    [1.1.1b-1]
    - update to the 1.1.1b release
    - EVP_KDF API backport from master
    - SSH KDF implementation for EVP_KDF API backport from master
    - add S390x chacha20-poly1305 assembler support from master branch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3700 advisory.

  - openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)

  - openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)

  - openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the April 2020 CPU advisory.

  - Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer     overflow via a crafted regular expression that triggers     invalid write operations. (CVE-2018-18311)

  - ChaCha20-Poly1305 is an AEAD cipher, and requires a     unique nonce input for every encryption operation. RFC     7539 specifies that the nonce value (IV) should be 96     bits (12 bytes). OpenSSL allows a variable nonce length     and front pads the nonce with 0 bytes if it is less than     12 bytes. However it also incorrectly allows a nonce to     be set of up to 16 bytes. In this case only the last 12     bytes are significant and any additional leading bytes     are ignored. It is a requirement of using this cipher     that nonce values are unique. Messages encrypted using a     reused nonce value are susceptible to serious     confidentiality and integrity attacks. If an application     changes the default nonce length to be longer than 12     bytes and then makes a change to the leading bytes of     the nonce expecting the new value to be a new unique     nonce then such an application could inadvertently     encrypt messages with a reused nonce. Additionally the     ignored bytes in a long nonce are not covered by the     integrity guarantee of this cipher. Any application that     relies on the integrity of these ignored leading bytes     of a long nonce may be further affected. Any OpenSSL     internal use of this cipher, including in SSL/TLS, is     safe because no such use sets such a long nonce value.
    However user applications that use this cipher directly     and set a non-default nonce length to be longer than 12     bytes may be vulnerable. OpenSSL versions 1.1.1 and     1.1.0 are affected by this issue. Due to the limited     scope of affected deployments this has been assessed as     low severity and therefore we are not creating new     releases at this time. Fixed in OpenSSL 1.1.1c (Affected     1.1.1-1.1.1b). Fixed in OpenSSL 1.1.0k (Affected     1.1.0-1.1.0j). (CVE-2019-1543)

  - Vulnerability in the Enterprise Manager Base Platform product   of Oracle Enterprise Manager (component: Discovery Framework   (Oracle OHS)). Supported versions that are affected are 13.2.0.0   and 13.3.0.0. Easily exploitable vulnerability allows unauthenticated   attacker with network access via HTTP to compromise Enterprise Manager   Base Platform. Successful attacks of this vulnerability can result   in takeover of Enterprise Manager Base Platform. (CVE-2020-2961)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3700 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    The following packages have been upgraded to a later upstream version: openssl (1.1.1c). (BZ#1643026)

    Security Fix(es):

    * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734)

    * openssl: timing side channel attack in the ECDSA signature generation (CVE-2018-0735)

    * openssl: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Oracle reports :

This Critical Patch Update contains 31 new security fixes for Oracle MySQL. 6 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

The version of Oracle MySQL Connectors installed on the remote host is 8.0.x prior to 8.0.18 or 5.3.x prior to 5.3.14.
It is, therefore, affected by the following vulnerabilities as noted in the October 2019 Critical Patch Update advisory:

  - An unspecified, remote security vulnerability in the Connector/ODBC component of Oracle MySQL Connectors.
    (CVE-2019-2920)

  - A vulnerability in the OpenSSL subcomponent of the Connector/ODBC component of Oracle MySQL Connectors caused by the     ability to set variable nonce lengths in the ChaCha20-Poly1305 AEAD cipher. This could allow an unauthenticated,     remote attacker to affect data confidentiality and integrity. (CVE-2019-1543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Patch for CVE-2018-0737, CVE-2018-0732, CVE-2018-0734, CVE-2019-1552, CVE-2019-1559.

https://www.openssl.org/news/vulnerabilities.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the openssl110h packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ChaCha20-Poly1305 is an AEAD cipher, and requires a     unique nonce input for every encryption operation. RFC     7539 specifies that the nonce value (IV) should be 96     bits (12 bytes). OpenSSL allows a variable nonce length     and front pads the nonce with 0 bytes if it is less     than 12 bytes. However it also incorrectly allows a     nonce to be set of up to 16 bytes. In this case only     the last 12 bytes are significant and any additional     leading bytes are ignored. It is a requirement of using     this cipher that nonce values are unique. Messages     encrypted using a reused nonce value are susceptible to     serious confidentiality and integrity attacks. If an     application changes the default nonce length to be     longer than 12 bytes and then makes a change to the     leading bytes of the nonce expecting the new value to     be a new unique nonce then such an application could     inadvertently encrypt messages with a reused nonce.
    Additionally the ignored bytes in a long nonce are not     covered by the integrity guarantee of this cipher. Any     application that relies on the integrity of these     ignored leading bytes of a long nonce may be further     affected. Any OpenSSL internal use of this cipher,     including in SSL/TLS, is safe because no such use sets     such a long nonce value. However user applications that     use this cipher directly and set a non-default nonce     length to be longer than 12 bytes may be vulnerable.
    OpenSSL versions 1.1.1 and 1.1.0 are affected by this     issue. Due to the limited scope of affected deployments     this has been assessed as low severity and therefore we     are not creating new releases at this     time.(CVE-2019-1543)

  - OpenSSL has internal defaults for a directory tree     where it can find a configuration file as well as     certificates used for verification in TLS. This     directory is most commonly referred to as OPENSSLDIR,     and is configurable with the --prefix / --openssldir     configuration options. For OpenSSL versions 1.1.0 and     1.1.1, the mingw configuration targets assume that     resulting programs and libraries are installed in a     Unix-like environment and the default prefix for     program installation as well as for OPENSSLDIR should     be '/usr/local'. However, mingw programs are Windows     programs, and as such, find themselves looking at     sub-directories of 'C:/usr/local', which may be world     writable, which enables untrusted users to modify     OpenSSL's default configuration, insert CA     certificates, modify (or even replace) existing engine     modules, etc. For OpenSSL 1.0.2, '/usr/local/ssl' is     used as default for OPENSSLDIR on all Unix and Windows     targets, including Visual C builds. However, some build     instructions for the diverse Windows targets on 1.0.2     encourage you to specify your own --prefix. OpenSSL     versions 1.1.1, 1.1.0 and 1.0.2 are affected by this     issue. Due to the limited scope of affected deployments     this has been assessed as low severity and therefore we     are not creating new releases at this time.
    (CVE-2019-1552)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for virtualbox to version 6.0.10 fixes the following issues :

Security issues fixed :

  - CVE-2019-2859 CVE-2019-2867 CVE-2019-2866 CVE-2019-2864     CVE-2019-2865 CVE-2019-1543 CVE-2019-2863 CVE-2019-2848     CVE-2019-2877 CVE-2019-2873 CVE-2019-2874 CVE-2019-2875     CVE-2019-2876 CVE-2019-2850 (boo#1141801)

The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.32 or 6.0.x prior to 6.0.10. It is, therefore, affected by multiple vulnerabilities as noted in the July 2019 Critical Patch Update advisory:

  - An unspecified vulnerabilities in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core),     which could allow an authenticated, local attacker to takeover Oracle VM VirtualBox. (CVE-2019-2859, CVE-2019-2863,     CVE-2019-2866, CVE-2019-2867) 

  - An unspecified vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core     (OpenSSL)), which could allow an unauthenticated, remote attacker to create, delete of modify critical data Oracle     VM VirtualBox. (CVE-2019-1543)

  - An unspecified vulnerabilities in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core),     which could allow an authenticated, local attacker to cause a hang or repeatable crach (DoS) of Oracle VM     VirtualBox. (CVE-2019-2848, CVE-2019-2873, CVE-2019-2874, CVE-2019-2875, CVE-2019-2876, CVE-2019-2877)

Joran Dirk Greef discovered that overly long nonces used with ChaCha20-Poly1305 were incorrectly processed and could result in nonce reuse. This doesn't affect OpenSSL-internal uses of ChaCha20-Poly1305 such as TLS.

The version of OpenSSL installed on the remote host is prior to 1.1.0k. It is, therefore, affected by a vulnerability as referenced in the 1.1.0k advisory.

  - ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC     7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce     length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly     allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any     additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are     unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and     integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then     makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then     such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored     bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that     relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any     OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long     nonce value. However user applications that use this cipher directly and set a non-default nonce length to     be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue.
    Due to the limited scope of affected deployments this has been assessed as low severity and therefore we     are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in     OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j). (CVE-2019-1543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of OpenSSL installed on the remote host is prior to 1.1.1c. It is, therefore, affected by a vulnerability as referenced in the 1.1.1c advisory.

  - ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC     7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce     length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly     allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any     additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are     unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and     integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then     makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then     such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored     bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that     relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any     OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long     nonce value. However user applications that use this cipher directly and set a non-default nonce length to     be longer than 12 bytes may be vulnerable. OpenSSL versions 1.1.1 and 1.1.0 are affected by this issue.
    Due to the limited scope of affected deployments this has been assessed as low severity and therefore we     are not creating new releases at this time. Fixed in OpenSSL 1.1.1c (Affected 1.1.1-1.1.1b). Fixed in     OpenSSL 1.1.0k (Affected 1.1.0-1.1.0j). (CVE-2019-1543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the openssl110f packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ChaCha20-Poly1305 is an AEAD cipher, and requires a     unique nonce input for every encryption operation. RFC     7539 specifies that the nonce value (IV) should be 96     bits (12 bytes). OpenSSL allows a variable nonce length     and front pads the nonce with 0 bytes if it is less     than 12 bytes. However it also incorrectly allows a     nonce to be set of up to 16 bytes. In this case only     the last 12 bytes are significant and any additional     leading bytes are ignored. It is a requirement of using     this cipher that nonce values are unique. Messages     encrypted using a reused nonce value are susceptible to     serious confidentiality and integrity attacks. If an     application changes the default nonce length to be     longer than 12 bytes and then makes a change to the     leading bytes of the nonce expecting the new value to     be a new unique nonce then such an application could     inadvertently encrypt messages with a reused nonce.
    Additionally the ignored bytes in a long nonce are not     covered by the integrity guarantee of this cipher. Any     application that relies on the integrity of these     ignored leading bytes of a long nonce may be further     affected. Any OpenSSL internal use of this cipher,     including in SSL/TLS, is safe because no such use sets     such a long nonce value. However user applications that     use this cipher directly and set a non-default nonce     length to be longer than 12 bytes may be vulnerable.
    OpenSSL versions 1.1.1 and 1.1.0 are affected by this     issue. Due to the limited scope of affected deployments     this has been assessed as low severity and therefore we     are not creating new releases at this     time.(CVE-2019-1543)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_1 (OpenSSL Security Advisory [6 March 2019]) fixes the following issues :

Security issue fixed: &#9; 

  - CVE-2019-1543: Fixed an implementation error in     ChaCha20-Poly1305 where it was allowed to set IV with     more than 12 bytes (bsc#1128189). Other issues addressed :

  - Fixed a segfault in openssl speed when an unknown     algorithm is passed (bsc#1125494).

  - Correctly skipped binary curves in openssl speed to     avoid spitting errors (bsc#1116833).

This update was imported from the SUSE:SLE-15:Update update project.

This update for openssl-1_1 (OpenSSL Security Advisory [6 March 2019]) fixes the following issues :

Security issue fixed :

CVE-2019-1543: Fixed an implementation error in ChaCha20-Poly1305 where it was allowed to set IV with more than 12 bytes (bsc#1128189).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openssl-1_1 (OpenSSL Security Advisory [6 March 2019]) fixes the following issues :

Security issue fixed :

CVE-2019-1543: Fixed an implementation error in ChaCha20-Poly1305 where it was allowed to set IV with more than 12 bytes (bsc#1128189).

Other issues addressed: Fixed a segfault in openssl speed when an unknown algorithm is passed (bsc#1125494).

Correctly skipped binary curves in openssl speed to avoid spitting errors (bsc#1116833).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The OpenSSL project reports :

Low: ChaCha20-Poly1305 with long nonces (CVE-2019-1543)

ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored.

ID	Name	Product	Family	Severity
180654	Oracle Linux 8 : openssl (ELSA-2019-3700)	Nessus	Oracle Linux Local Security Checks	high
145661	CentOS 8 : openssl (CESA-2019:3700)	Nessus	CentOS Local Security Checks	high
135679	Oracle Enterprise Manager Cloud Control (Apr 2020 CPU)	Nessus	Misc.	critical
130567	RHEL 8 : openssl (RHSA-2019:3700)	Nessus	Red Hat Local Security Checks	high
130496	FreeBSD : MySQL -- Multiple vulerabilities (fc91f2ef-fd7b-11e9-a1c7-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	high
129974	Oracle MySQL Connectors Multiple Vulnerabilities (Oct 2019 CPU)	Nessus	Misc.	high
129653	Fedora 31 : 1:compat-openssl10 (2019-db06efdea1)	Nessus	Fedora Local Security Checks	high
129368	Fedora 29 : 1:compat-openssl10 (2019-9a0a7c0986)	Nessus	Fedora Local Security Checks	high
129319	Fedora 30 : 1:compat-openssl10 (2019-00c25b9379)	Nessus	Fedora Local Security Checks	high
128813	EulerOS 2.0 SP5 : openssl110h (EulerOS-SA-2019-1890)	Nessus	Huawei Local Security Checks	high
127734	openSUSE Security Update : virtualbox (openSUSE-2019-1814)	Nessus	SuSE Local Security Checks	critical
126778	Oracle VM VirtualBox 5.2.x < 5.2.32 / 6.0.x < 6.0.10 (Jul 2019 CPU)	Nessus	Misc.	high
126392	Debian DSA-4475-1 : openssl - security update	Nessus	Debian Local Security Checks	high
125642	OpenSSL 1.1.0 < 1.1.0k Vulnerability	Nessus	Web Servers	high
125641	OpenSSL 1.1.1 < 1.1.1c Vulnerability	Nessus	Web Servers	high
124614	EulerOS 2.0 SP3 : openssl110f (EulerOS-SA-2019-1328)	Nessus	Huawei Local Security Checks	high
124613	EulerOS 2.0 SP2 : openssl110f (EulerOS-SA-2019-1327)	Nessus	Huawei Local Security Checks	high
123776	openSUSE Security Update : openssl-1_1 (openSUSE-2019-1147)	Nessus	SuSE Local Security Checks	high
123498	SUSE SLED12 / SLES12 Security Update : openssl-1_1 (SUSE-SU-2019:0787-1)	Nessus	SuSE Local Security Checks	high
123060	SUSE SLED15 / SLES15 Security Update : openssl-1_1 (SUSE-SU-2019:0678-1)	Nessus	SuSE Local Security Checks	high
122686	FreeBSD : OpenSSL -- ChaCha20-Poly1305 nonce vulnerability (e56f2f7c-410e-11e9-b95c-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2019-1543

high

Tenable Plugins

high

high

critical

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high