Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

SUSE: 2020:2035-1 Critical Update for libcurl Denial Of Service Risk

suse
Calendar Grey July 23, 2018
Scroller Suse
SUSE Linux has released a new update tackling a Denial of Service vulnerability while enhancing the key exchange protocols within openssl-1_1. Discover the specifics today.
An update that solves one vulnerability and has two fixes is now available

Summary

This update for openssl-1_1 fixes the following issues: - CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158). - Blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Module for Basesystem 15:

Topics%20covered

Topics Covered

security advisory update DoS patch SUSE openssl key agreement

References

#1097158 #1097624 #1098592

Cross- CVE-2018-0732

Affected Products:

SUSE Linux Enterprise Module for Basesystem 15

https://www.suse.com/security/cve/CVE-2018-0732.html

https://bugzilla.suse.com/1097158

https://bugzilla.suse.com/1097624

https://bugzilla.suse.com/1098592

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2018:2036-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory update DoS patch SUSE openssl key agreement

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.