The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3449 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3449-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Sylvain Beucler     June 08, 2023                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : openssl     Version        : 1.1.1n-0+deb10u5     CVE ID         : CVE-2023-0464 CVE-2023-0465 CVE-2023-0466 CVE-2023-2650     Debian Bug     : 1034720

    Multiple vulnerabilities have been discovered in OpenSSL, a Secure     Sockets Layer toolkit.

    CVE-2023-0464

        David Benjamin reported a flaw related to the verification of         X.509 certificate chains that include policy constraints, which         may result in denial of service.

    CVE-2023-0465

        David Benjamin reported that invalid certificate policies in leaf         certificates are silently ignored. A malicious CA could take         advantage of this flaw to deliberately assert invalid certificate         policies in order to circumvent policy checking on the certificate         altogether.

    CVE-2023-0466

        David Benjamin discovered that the implementation of the         X509_VERIFY_PARAM_add0_policy() function does not enable the check         which allows certificates with invalid or incorrect policies to         pass the certificate verification (contrary to its documentation).

    CVE-2023-2650

        It was discovered that processing malformed ASN.1 object         identifiers or data may result in denial of service.

    For Debian 10 buster, these problems have been fixed in version     1.1.1n-0+deb10u5.

    We recommend that you upgrade your openssl packages.

    For the detailed security status of openssl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/openssl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3449 : libssl-dev - security update

high Nessus Plugin ID 176985

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Jan 22, 2025, 5:44 PM CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:U") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N") Plugin metadata Plugin Feed: 202501221744
Version 1.1 Aug 10, 2023, 4:05 PM IAVM reference Plugin Feed: 202308101605
Version 1.0 Jun 9, 2023, 2:18 AM New Plugin Feed: 202306090218