TI-2018-00683 CVE-2018-0735 · GHSA-4fhm-44hf-3465
Timing attack against ECDSA signature generation
Priority MEDIUM 40
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack.
RHSA-2019:0483
openssl security and bug fix update
Released 2019-03-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.2k-16.el7_6.1, openssl-libs-1:1.0.2k-16.el7_6.1
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.2k-16.el7_6.1, openssl-perl-1:1.0.2k-16.el7_6.1, openssl-static-1:1.0.2k-16.el7_6.1
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.2k-16.el7_6.1, openssl-libs-1:1.0.2k-16.el7_6.1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.2k-16.el7_6.1, openssl-perl-1:1.0.2k-16.el7_6.1, openssl-static-1:1.0.2k-16.el7_6.1
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.2k-16.el7_6.1, openssl-devel-1:1.0.2k-16.el7_6.1, openssl-devel-1:1.0.2k-16.el7_6.1.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.2k-16.el7_6.1, openssl-static-1:1.0.2k-16.el7_6.1, openssl-static-1:1.0.2k-16.el7_6.1.ppc
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.2k-16.el7_6.1, openssl-devel-1:1.0.2k-16.el7_6.1, openssl-libs-1:1.0.2k-16.el7_6.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.2k-16.el7_6.1, openssl-static-1:1.0.2k-16.el7_6.1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) openssl-1:1.0.2k-16.el7_6.1, openssl-devel-1:1.0.2k-16.el7_6.1, openssl-libs-1:1.0.2k-16.el7_6.1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) openssl-perl-1:1.0.2k-16.el7_6.1, openssl-static-1:1.0.2k-16.el7_6.1
Fixes 2 records
TI-2018-03935 CVE-2018-5407 · GHSA-3rjg-j575-7f6p
Information disclosure in Processors supporting Simultaneous Multi-Threading
Priority LOW 28
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.