The remote Ubuntu 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5710-1 advisory.

    It was discovered that OpenSSL incorrectly handled certain X.509 Email Addresses. If a certificate     authority were tricked into signing a specially-crafted certificate, a remote attacker could possibly use     this issue to cause OpenSSL to crash, resulting in a denial of service. The default compiler options for     affected releases reduce the vulnerability to a denial of service. (CVE-2022-3602, CVE-2022-3786)

    It was discovered that OpenSSL incorrectly handled applications creating custom ciphers via the legacy     EVP_CIPHER_meth_new() function. This issue could cause certain applications that mishandled values to the     function to possibly end up with a NULL cipher and messages in plaintext. (CVE-2022-3358)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 22.04 LTS : OpenSSL vulnerabilities (USN-5710-1)

high Nessus Plugin ID 166798

Version 1.13

Version 1.12

Version 1.11

Version 1.10

Version 1.10

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.13 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.12 Oct 23, 2023, 6:27 PM Detection Exploit attributes ("Exploit available" set to "False") Plugin metadata Plugin Feed: 202310231827
Version 1.11 Jul 11, 2023, 4:01 AM Detection Plugin Feed: 202307110401
Version 1.10 Jan 18, 2023, 9:01 AM Logic Changes (Added support for s390x) Plugin Feed: 202301180901
Version 1.10 Jul 11, 2023, 1:48 AM Detection Plugin Feed: 202307110148
Version 1.9 Dec 15, 2022, 4:16 PM IAVM reference Plugin Feed: 202212151616
Version 1.8 Dec 5, 2022, 10:02 PM Reference Plugin Feed: 202212052202
Version 1.7 Nov 28, 2022, 4:23 PM CVSSv2 severity (based on CVE-2022-3358, severity increased from "Medium" to "High") CVSS metrics ("CVSSv2 score" changed from "5.0" to "7.8") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P" to "CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N") CVSSv2 score source (changed from "CVE-2022-3786" to "CVE-2022-3358") Plugin Feed: 202211281623
Version 1.6 Nov 8, 2022, 10:01 AM IAVM reference Plugin Feed: 202211081001
Version 1.5 Nov 7, 2022, 3:54 PM CVSSv3 score source (Changed from CVE-2022-3602 to CVE-2022-3358) CVSS metrics Plugin Feed: 202211071554
Version 1.4 Nov 4, 2022, 11:48 AM IAVM reference Plugin Feed: 202211041148
Version 1.3 Nov 3, 2022, 4:28 PM CVSS metrics CVSSv3 score source (Changed from CVE-2022-3358 to CVE-2022-3602) Plugin Feed: 202211031628
Version 1.2 Nov 2, 2022, 1:46 PM New Plugin Feed: 202211021346