According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a     memory-cache side-channel attack on ECDSA signatures     that can be mitigated through the use of blinding     during the signing process in the _gcry_ecc_ecdsa_sign     function in cipher/ecc-ecdsa.c, aka the Return Of the     Hidden Number Problem or ROHNP. To discover an ECDSA     key, the attacker needs access to either the local     machine or a different virtual machine on the same     physical host.i1/4^CVE-2018-0495i1/4%0

  - During key agreement in a TLS handshake using a DH(E)     based ciphersuite a malicious server can send a very     large prime value to the client. This will cause the     client to spend an unreasonably long period of time     generating a key for this prime resulting in a hang     until the client has finished. This could be exploited     in a Denial Of Service attack. Fixed in OpenSSL     1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL     1.0.2p-dev (Affected 1.0.2-1.0.2o).i1/4^CVE-2018-0732i1/4%0

  - Constructed ASN.1 types with a recursive definition     (such as can be found in PKCS7) could eventually exceed     the stack given malicious input with excessive     recursion. This could result in a Denial Of Service     attack. There are no such structures used within     SSL/TLS that come from untrusted sources so this is     considered safe. Fixed in OpenSSL 1.1.0h (Affected     1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected     1.0.2b-1.0.2n).i1/4^CVE-2018-0739i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for MozillaFirefox, mozilla-nss and mozilla-nspr fixes the following issues :

Issues fixed in MozillaFirefox :

Update to Firefox ESR 60.4 (bsc#1119105)

CVE-2018-17466: Fixed a buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11

CVE-2018-18492: Fixed a use-after-free with select element

CVE-2018-18493: Fixed a buffer overflow in accelerated 2D canvas with Skia

CVE-2018-18494: Fixed a Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs

CVE-2018-18498: Fixed a integer overflow when calculating buffer sizes for images

CVE-2018-12405: Fixed a few memory safety bugs

Issues fixed in mozilla-nss: Update to NSS 3.40.1 (bsc#1119105)

CVE-2018-12404: Fixed a cache side-channel variant of the Bleichenbacher attack (bsc#1119069)

CVE-2018-12384: Fixed an issue in the SSL handshake. NSS responded to an SSLv2-compatible ClientHello with a ServerHello that had an all-zero random. (bsc#1106873)

CVE-2018-0495: Fixed a memory-cache side-channel attack with ECDSA signatures (bsc#1097410)

Fixed a decryption failure during FFDHE key exchange

Various security fixes in the ASN.1 code

Issues fixed in mozilla-nspr: Update mozilla-nspr to 4.20 (bsc#1119105)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issue: The following security issue was fixed :

  - CVE-2018-0495: Fixed a novel side-channel attack, by     enabling blinding for ECDSA signatures (bsc#1097410)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1461 advisory.

    The nss-softokn package provides the Network Security Services Softoken Cryptographic Module.

    Security Fix(es):

    * nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate     (CVE-2019-11745)

    * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Minor update to version 1.1.1a with bug fixes and low impact security fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgcrypt fixes the following issue :

The following security issue was fixed :

  - CVE-2018-0495: Fixed a novel side-channel attack, by     enabling blinding for ECDSA signatures (bsc#1097410)

This update was imported from the SUSE:SLE-15:Update update project.

It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys.

It was discovered that Libgcrypt is prone to a local side-channel attack allowing recovery of ECDSA private keys.

For Debian 8 'Jessie', these problems have been fixed in version 1.6.3-2+deb8u5.

We recommend that you upgrade your libgcrypt20 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3689-1 advisory.

    Keegan Ryan discovered that Libgcrypt was susceptible to a side-channel attack. A local attacker could     possibly use this attack to recover ECDSA private keys.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1267 advisory.

    The nss-softokn package provides the Network Security Services Softoken Cryptographic Module.

    Security Fix(es):

    * nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate     (CVE-2019-11745)

    * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
123871	EulerOS Virtualization 2.5.3 : openssl (EulerOS-SA-2019-1185)	Nessus	Huawei Local Security Checks	4/9/2019	6/4/2024	medium
119871	SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nspr / mozilla-nss (SUSE-SU-2018:4236-1)	Nessus	SuSE Local Security Checks	12/24/2018	7/12/2024	critical
120054	SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2018:1993-1)	Nessus	SuSE Local Security Checks	1/2/2019	7/11/2024	medium
135460	RHEL 7 : nss-softokn (RHSA-2020:1461)	Nessus	Red Hat Local Security Checks	4/14/2020	11/7/2024	high
121239	Fedora 29 : 1:openssl (2019-a8ffcff7ee)	Nessus	Fedora Local Security Checks	1/18/2019	6/26/2024	medium
111421	openSUSE Security Update : libgcrypt (openSUSE-2018-769)	Nessus	SuSE Local Security Checks	7/30/2018	9/2/2024	medium
110572	Debian DSA-4231-1 : libgcrypt20 - security update	Nessus	Debian Local Security Checks	6/18/2018	9/20/2024	medium
110814	Debian DLA-1405-1 : libgcrypt20 security update	Nessus	Debian Local Security Checks	7/2/2018	9/10/2024	medium
110623	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : Libgcrypt vulnerability (USN-3689-1)	Nessus	Ubuntu Local Security Checks	6/20/2018	8/27/2024	medium
135092	RHEL 7 : nss-softokn (RHSA-2020:1267)	Nessus	Red Hat Local Security Checks	4/1/2020	11/8/2024	high
123229	openSUSE Security Update : libgcrypt (openSUSE-2019-540)	Nessus	SuSE Local Security Checks	3/27/2019	6/11/2024	medium

Detections

Analytics

Plugins Search

medium

critical

medium

high

medium

medium

medium

medium

medium

high

medium