TI-2018-00680 CVE-2018-0732 · GHSA-497c-86pp-222m
Client DoS due to large DH parameter
Priority HIGH 69
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client.
RHSA-2018:3221
openssl security, bug fix, and enhancement update
Released 2018-10-30 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.2k-16.el7, openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.2k-16.el7, openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7.ppc
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) openssl-1:1.0.2k-16.el7, openssl-devel-1:1.0.2k-16.el7, openssl-libs-1:1.0.2k-16.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) openssl-perl-1:1.0.2k-16.el7, openssl-static-1:1.0.2k-16.el7
Fixes 5 records
TI-2018-00685 CVE-2018-0739 · GHSA-2qcx-c97v-hcr6
Constructed ASN.1 types with a recursive definition could exceed the stack
Priority MEDIUM 47
Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion.
TI-2017-02851 CVE-2017-3735 · GHSA-6h3q-hmhp-4vgv
Memory corruption in OpenSSL
Priority MEDIUM 43
While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread.
TI-2018-00684 CVE-2018-0737 · GHSA-rj52-j648-hww8
Cache timing vulnerability in RSA Key Generation
Priority MEDIUM 40
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack.
TI-2018-00452 CVE-2018-0495 · GHSA-q2v2-pgm4-m8c8
Observable discrepancy in Libgcrypt before 1.7.10 and 1.8.x before 1.8.3
Priority LOW 23
Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign functi…