Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 522
Alerts This Week
Warning Icon 1 522

SUSE: 2018:1887-2 Moderate: OpenSSL Denial Of Service Fix

suse
Calendar Grey October 18, 2018
Dist Suse Esm H88
SUSE Security Patch addresses vulnerabilities in openssl, encompassing risks of Denial of Service and enhancements. Discover additional details here.
An update that solves one vulnerability and has two fixes is now available

Summary

This update for openssl fixes the following issues: - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158). - Blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-SP2-BCL: zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2018-1276=1

Topics%20covered

Topics Covered

security advisory denial of service service update openssl SUSE Linux Enterprise

References

#1097158 #1097624 #1098592

Cross- CVE-2018-0732

Affected Products:

SUSE Linux Enterprise Server 12-SP2-BCL

https://www.suse.com/security/cve/CVE-2018-0732.html

https://bugzilla.suse.com/1097158

https://bugzilla.suse.com/1097624

https://bugzilla.suse.com/1098592

Announcement ID: SUSE-SU-2018:1887-2
Rating: moderate

Topics%20covered

Topics Covered

security advisory denial of service service update openssl SUSE Linux Enterprise

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.