Advisories ยป MGASA-2018-0365

Updated openssl packages fix security vulnerabilities

Publication date: 02 Sep 2018
Modification date: 02 Sep 2018
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-0732 , CVE-2018-0737

Description

Updated openssl packages fix security vulnerabilities:

During key agreement in a TLS handshake using a DH(E) based ciphersuite a
malicious server can send a very large prime value to the client. This will
cause the client to spend an unreasonably long period of time generating a
key for this prime resulting in a hang until the client has finished. This
could be exploited in a Denial Of Service attack (CVE-2018-0732).

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to
a cache timing side channel attack. An attacker with sufficient access to
mount cache timing attacks during the RSA key generation process could
recover the private key (CVE-2018-0737).

References

SRPMS

6/core