Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3871-1 advisory.

    - CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)
    - CVE-2024-41996: Avoid expensive public key validation for known safe-prime groups (DHEATATTACK)     (bsc#1230698)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000148343 advisory.

    Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved     safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive     server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption.
    The basic attack scenario is that the client must claim that it can only communicate with DHE, and the     server must be configured to allow DHE and validate the order of the public key.(CVE-2024-41996)Note: For     more information, refer to theD(HE)at Attackproject page. This link takes you to a resource outside of     MyF5, and the third party could remove the document without our knowledge.

Tenable has extracted the preceding description block directly from the F5 Networks BIG-IP security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3766-1 advisory.

    - CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)
    - CVE-2024-41996: Avoid expensive public key validation for known safe-prime groups (DHEATATTACK)     (bsc#1230698)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-727 advisory.

    Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved     safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive     server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption.
    The basic attack scenario is that the client must claim that it can only communicate with DHE, and the     server must be configured to allow DHE and validate the order of the public key. (CVE-2024-41996)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3525-1 advisory.

    - CVE-2024-41996: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol,     when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE     (bsc#1230698)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3501-1 advisory.

    - CVE-2024-41996: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol,     when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE     (bsc#1230698)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3500-1 advisory.

    - CVE-2024-41996: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol,     when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE     (bsc#1230698)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210104	SUSE SLES15 Security Update : openssl-3 (SUSE-SU-2024:3871-1)	Nessus	SuSE Local Security Checks	high
209915	F5 Networks BIG-IP : Diffie-Hellman key exchange protocol vulnerability (K000148343)	Nessus	F5 Networks Local Security Checks	high
209895	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : openssl-3 (SUSE-SU-2024:3766-1)	Nessus	SuSE Local Security Checks	high
208967	Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-727)	Nessus	Amazon Linux Local Security Checks	high
208208	SUSE SLES15 Security Update : openssl-3 (SUSE-SU-2024:3525-1)	Nessus	SuSE Local Security Checks	high
208019	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : openssl-3 (SUSE-SU-2024:3501-1)	Nessus	SuSE Local Security Checks	high
207958	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : openssl-3 (SUSE-SU-2024:3500-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2024-41996

high

Tenable Plugins

high

high

high

high

high

high

high