This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed :

  - CVE-2016-7056: A local ECSDA P-256 timing attack that     might have allowed key recovery was fixed (bsc#1019334)

  - CVE-2016-8610: A remote denial of service in SSL alert     handling was fixed (bsc#1005878)

  - CVE-2016-2108: Added a missing commit for CVE-2016-2108,     fixing the negative zero handling in the ASN.1 decoder     (bsc#1004499)

  - CVE-2017-3731: Truncated packet could crash via OOB read     (bsc#1022085, CVE-2017-3731)

  - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912)     Bugs fixed :

  - fix crash in openssl speed (bsc#1000677)

  - fix ca-bundle path (bsc#1022271)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es) :

* An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731)

* A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)

An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731)

A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)

Minor upstream release fixing CVE-2016-8610, CVE-2017-3731, CVE-2017-3732.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2493 advisory.

    OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS)     protocols, as well as a full-strength general-purpose cryptography library.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    This release provides an update to OpenSSL and Tomcat 6/7 for Red Hat JBoss Web Server 2.1.2. The updates     are documented in the Release Notes document linked to in the References.

    Users of Red Hat JBoss Web Server 2.1.2 should upgrade to these updated packages, which resolve several     security issues.

    Security Fix(es):

    * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session     renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of     memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling     support. (CVE-2016-6304)

    * A vulnerability was discovered in tomcat's handling of pipelined requests when Sendfile was used. If     sendfile processing completed quickly, it was possible for the Processor to be added to the processor     cache twice. This could lead to invalid responses or information disclosure. (CVE-2017-5647)

    * A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A     crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of     the custom error page. (CVE-2017-5664)

    * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets     during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an     excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610)

    Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of     Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.)     as the original reporter of CVE-2016-6304.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update is now available for Red Hat JBoss Core Services on RHEL 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.

This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References.

Security Fix(es) :

* A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304)

* It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user's browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack.
(CVE-2016-0736)

* It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication. (CVE-2016-2161)

* A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.
(CVE-2016-7056)

* A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610)

* It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)

* A vulnerability was found in httpd's handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server's available memory, causing httpd to crash.
(CVE-2016-8740)

Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304.

According to its banner, the version of OpenSSL on the remote host is version 1.1.0 prior to 1.1.0b and is affected by multiple vulnerabilities :

 - A flaw exists in the 'read_state_machine()' function of 'ssl/statem/statem.c'.  The issue is triggered when handling messages larger than ~ 16k.  With a specially crafted message, a remote attacker can trigger a use-after-free leading to a denial of service or potentially remote code execution. (CVE-2016-6309)
 - A flaw exists that is triggered when handling many consecutive 'SSL3_AL_WARNING' undefined alerts.  By continuously sending warning alerts, a remote attacker can cause a process linked against the library to exhaust available CPU resources and potentially stop responding. (CVE-2016-8610)

According to its banner, the version of OpenSSL on the remote host is 1.0.2 prior to 1.0.2j and is affected by multiple DoS vulnerabilities :

 - A flaw exists in the CRL functionality that is triggered when handling a certificate revocation list (CRL).  With a specially crafted CRL, a context-dependent attacker can cause the service to crash due to a NULL pointer being dereferenced. (CVE-2016-7052)
 - A flaw exists that is triggered when handling many consecutive 'SSL3_AL_WARNING' undefined alerts.  By continuously sending warning alerts, a remote attacker can cause a process linked against the library to exhaust available CPU resources and potentially stop responding. (CVE-2016-8610)

ID	Name	Product	Family	Published	Updated	Severity
97188	SUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2017:0461-1)	Nessus	SuSE Local Security Checks	2/15/2017	1/6/2021	critical
97305	CentOS 6 / 7 : openssl (CESA-2017:0286)	Nessus	CentOS Local Security Checks	2/22/2017	1/4/2021	high
97555	Amazon Linux AMI : openssl (ALAS-2017-803)	Nessus	Amazon Linux Local Security Checks	3/7/2017	4/18/2018	high
97180	Fedora 24 : 1:openssl (2017-e853b4144f)	Nessus	Fedora Local Security Checks	2/15/2017	1/6/2021	high
102692	RHEL 6 / 7 : Red Hat JBoss Web Server 2 (RHSA-2017:2493)	Nessus	Red Hat Local Security Checks	8/23/2017	11/5/2024	high
117316	RHEL 6 : JBoss Core Services (RHSA-2017:1414)	Nessus	Red Hat Local Security Checks	9/6/2018	8/12/2024	high
9628	OpenSSL 1.1.0 < 1.1.0b Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	10/6/2016	3/6/2019	critical
9627	OpenSSL 1.0.2 < 1.0.2j Multiple DoS	Nessus Network Monitor	Web Servers	10/6/2016	3/6/2019	medium

Detections

Analytics

Plugins Search

critical

high

high

high

high

high

critical

medium