Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

SUSE: 2018:1768-1 Moderate: nagios-nrpe Man-In-The-Middle Attack Fix

suse
Calendar Grey June 20, 2018
Dist Suse Esm H88
SUSE has released a Security Update for nagios-nrpe addressing a notable vulnerability linked to Logjam attacks. Ensure you apply the patch promptly!
An update that fixes one vulnerability is now available

Summary

This update for nagios-nrpe fixes one issue. This security issue was fixed: - CVE-2015-4000: Prevent Logjam. The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, did not properly convey a DHE_EXPORT choice, which allowed man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE (bsc#938906). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4: zypper in -t patch slessp4-nagios-nrpe-13667=1 - SUSE Linux Enterprise Debuginfo 11-SP4:

Topics%20covered

Topics Covered

security advisory moderate man-in-the-middle TLS security SUSE Linux Enterprise Server nagios-nrpe

References

#938906

Cross- CVE-2015-4000

Affected Products:

SUSE Linux Enterprise Server 11-SP4

SUSE Linux Enterprise Debuginfo 11-SP4

https://www.suse.com/security/cve/CVE-2015-4000.html

https://bugzilla.suse.com/938906

Announcement ID: SUSE-SU-2018:1768-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate man-in-the-middle TLS security SUSE Linux Enterprise Server nagios-nrpe

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here