SUSE-SU-2018:3864-2

Vulnerability from csaf_suse - Published: 2019-04-27 13:33 - Updated: 2026-09-20 13:00
Summary
Security update for openssl
Severity
Moderate
Notes
Title of the patch: Security update for openssl
Description of the patch: This update for openssl fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). - CVE-2018-0737: Corrected the current error detection of the current fix (bsc#1106197). - CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018). - Add missing timing side channel patch for DSA signature generation (bsc#1113742). - Fixed the 'One and Done' side-channel attack on RSA (bsc#1104789). Non-security issues fixed: - Added openssl(cli) so that the packages that required the openssl binary can require this instead of the new openssl meta package (bsc#1101470).
Patchnames: SUSE-SLE-SAP-12-SP1-2019-1063
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2016-8610
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch —
Vendor Fix
Threats
Impact important
CVE-2018-0734
5.9 (Medium)
CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
Recommended 6 products, the same list as for CVE-2016-8610
Threats
Impact moderate
CVE-2018-0737
4.7 (Medium)
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 6 products, the same list as for CVE-2016-8610
Threats
Impact moderate
CVE-2018-5407
4.8 (Medium)
CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
Recommended 6 products, the same list as for CVE-2016-8610
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/s… self
https://www.suse.com/support/update/announcement/… self
https://lists.suse.com/pipermail/sle-security-upd… self
https://bugzilla.suse.com/1101470 self
https://bugzilla.suse.com/1104789 self
https://bugzilla.suse.com/1106197 self
https://bugzilla.suse.com/1110018 self
https://bugzilla.suse.com/1113534 self
https://bugzilla.suse.com/1113652 self
https://www.suse.com/security/cve/CVE-2016-8610/ self
https://www.suse.com/security/cve/CVE-2018-0734/ self
https://www.suse.com/security/cve/CVE-2018-0737/ self
https://www.suse.com/security/cve/CVE-2018-5407/ self
https://www.suse.com/security/cve/CVE-2016-8610 external
https://bugzilla.suse.com/1005878 external
https://bugzilla.suse.com/1005879 external
https://bugzilla.suse.com/1110018 external
https://bugzilla.suse.com/1120592 external
https://bugzilla.suse.com/1126909 external
https://bugzilla.suse.com/1148697 external
https://bugzilla.suse.com/982575 external
https://www.suse.com/security/cve/CVE-2018-0734 external
https://bugzilla.suse.com/1113534 external
https://bugzilla.suse.com/1113652 external
https://bugzilla.suse.com/1113742 external
https://bugzilla.suse.com/1122198 external
https://bugzilla.suse.com/1122212 external
https://bugzilla.suse.com/1126909 external
https://bugzilla.suse.com/1148697 external
https://www.suse.com/security/cve/CVE-2018-0737 external
https://bugzilla.suse.com/1089039 external
https://bugzilla.suse.com/1089041 external
https://bugzilla.suse.com/1089044 external
https://bugzilla.suse.com/1089045 external
https://bugzilla.suse.com/1108542 external
https://bugzilla.suse.com/1123780 external
https://bugzilla.suse.com/1126909 external
https://www.suse.com/security/cve/CVE-2018-5407 external
https://bugzilla.suse.com/1113534 external
https://bugzilla.suse.com/1116195 external
https://bugzilla.suse.com/1126909 external
https://bugzilla.suse.com/1148697 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for openssl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for openssl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).\n- CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534).\n- CVE-2018-0737: Corrected the current error detection of the current fix (bsc#1106197). \n- CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018).\n- Add missing timing side channel patch for DSA signature generation (bsc#1113742).\n- Fixed the \u0027One and Done\u0027 side-channel attack on RSA (bsc#1104789).\n\nNon-security issues fixed:\n\n- Added openssl(cli) so that the packages that required the openssl binary can require this instead of the new openssl meta package (bsc#1101470).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-SAP-12-SP1-2019-1063",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3864-2.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2018:3864-2",
        "url": "https://www.suse.com/support/update/announcement/2018/suse-su-20183864-2/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2018:3864-2",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2019-April/005383.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1101470",
        "url": "https://bugzilla.suse.com/1101470"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1104789",
        "url": "https://bugzilla.suse.com/1104789"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1106197",
        "url": "https://bugzilla.suse.com/1106197"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1110018",
        "url": "https://bugzilla.suse.com/1110018"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1113534",
        "url": "https://bugzilla.suse.com/1113534"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1113652",
        "url": "https://bugzilla.suse.com/1113652"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-8610 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-8610/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-0734 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-0734/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-0737 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-0737/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-5407 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-5407/"
      }
    ],
    "title": "Security update for openssl",
    "tracking": {
      "current_release_date": "2026-09-20T13:00:35Z",
      "generator": {
        "date": "2019-04-27T13:33:27Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2018:3864-2",
      "initial_release_date": "2019-04-27T13:33:27Z",
      "revision_history": [
        {
          "date": "2019-04-27T13:33:27Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T13:00:35Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openssl-doc-0:1.0.1i-54.20.1.noarch",
                "product": {
                  "name": "openssl-doc-0:1.0.1i-54.20.1.noarch",
                  "product_id": "openssl-doc-0:1.0.1i-54.20.1.noarch",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/openssl-doc@1.0.1i-54.20.1?arch=noarch\u0026upstream=openssl-0:1.0.1i-54.20.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
                "product": {
                  "name": "libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
                  "product_id": "libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libopenssl1_0_0@1.0.1i-54.20.1?arch=x86_64\u0026upstream=openssl-1_0_0-0:1.0.1i-54.20.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
                "product": {
                  "name": "libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
                  "product_id": "libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libopenssl1_0_0-32bit@1.0.1i-54.20.1?arch=x86_64\u0026upstream=openssl-1_0_0-0:1.0.1i-54.20.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
                "product": {
                  "name": "libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
                  "product_id": "libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libopenssl1_0_0-hmac@1.0.1i-54.20.1?arch=x86_64\u0026upstream=openssl-1_0_0-0:1.0.1i-54.20.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
                "product": {
                  "name": "libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
                  "product_id": "libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/libopenssl1_0_0-hmac-32bit@1.0.1i-54.20.1?arch=x86_64\u0026upstream=openssl-1_0_0-0:1.0.1i-54.20.1.src.rpm"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openssl-0:1.0.1i-54.20.1.x86_64",
                "product": {
                  "name": "openssl-0:1.0.1i-54.20.1.x86_64",
                  "product_id": "openssl-0:1.0.1i-54.20.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/openssl@1.0.1i-54.20.1?arch=x86_64\u0026upstream=openssl-0:1.0.1i-54.20.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64"
        },
        "product_reference": "libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64"
        },
        "product_reference": "libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64"
        },
        "product_reference": "libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64"
        },
        "product_reference": "libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-0:1.0.1i-54.20.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64"
        },
        "product_reference": "openssl-0:1.0.1i-54.20.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openssl-doc-0:1.0.1i-54.20.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
        },
        "product_reference": "openssl-doc-0:1.0.1i-54.20.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-8610",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-8610"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-8610",
          "url": "https://www.suse.com/security/cve/CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005878 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1005878"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1005879 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1005879"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1110018 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1110018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1120592 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1120592"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1126909 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1126909"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1148697 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/1148697"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 982575 for CVE-2016-8610",
          "url": "https://bugzilla.suse.com/982575"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-04-27T13:33:27Z",
          "details": "important"
        }
      ],
      "title": "CVE-2016-8610"
    },
    {
      "cve": "CVE-2018-0734",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-0734"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-0734",
          "url": "https://www.suse.com/security/cve/CVE-2018-0734"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1113534 for CVE-2018-0734",
          "url": "https://bugzilla.suse.com/1113534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1113652 for CVE-2018-0734",
          "url": "https://bugzilla.suse.com/1113652"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1113742 for CVE-2018-0734",
          "url": "https://bugzilla.suse.com/1113742"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1122198 for CVE-2018-0734",
          "url": "https://bugzilla.suse.com/1122198"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1122212 for CVE-2018-0734",
          "url": "https://bugzilla.suse.com/1122212"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1126909 for CVE-2018-0734",
          "url": "https://bugzilla.suse.com/1126909"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1148697 for CVE-2018-0734",
          "url": "https://bugzilla.suse.com/1148697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-04-27T13:33:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-0734"
    },
    {
      "cve": "CVE-2018-0737",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-0737"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2b-1.0.2o).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-0737",
          "url": "https://www.suse.com/security/cve/CVE-2018-0737"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1089039 for CVE-2018-0737",
          "url": "https://bugzilla.suse.com/1089039"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1089041 for CVE-2018-0737",
          "url": "https://bugzilla.suse.com/1089041"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1089044 for CVE-2018-0737",
          "url": "https://bugzilla.suse.com/1089044"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1089045 for CVE-2018-0737",
          "url": "https://bugzilla.suse.com/1089045"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1108542 for CVE-2018-0737",
          "url": "https://bugzilla.suse.com/1108542"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1123780 for CVE-2018-0737",
          "url": "https://bugzilla.suse.com/1123780"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1126909 for CVE-2018-0737",
          "url": "https://bugzilla.suse.com/1126909"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-04-27T13:33:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-0737"
    },
    {
      "cve": "CVE-2018-5407",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-5407"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on \u0027port contention\u0027.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-5407",
          "url": "https://www.suse.com/security/cve/CVE-2018-5407"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1113534 for CVE-2018-5407",
          "url": "https://bugzilla.suse.com/1113534"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1116195 for CVE-2018-5407",
          "url": "https://bugzilla.suse.com/1116195"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1126909 for CVE-2018-5407",
          "url": "https://bugzilla.suse.com/1126909"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1148697 for CVE-2018-5407",
          "url": "https://bugzilla.suse.com/1148697"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl1_0_0-hmac-32bit-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-0:1.0.1i-54.20.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:openssl-doc-0:1.0.1i-54.20.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2019-04-27T13:33:27Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-5407"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.