Test ID:	1.3.6.1.4.1.25623.1.1.4.2018.0112.1
Category:	SuSE Local Security Checks
Title:	SUSE: Security Advisory (SUSE-SU-2018:0112-1)
Summary:	The remote host is missing an update for the 'openssl' package(s) announced via the SUSE-SU-2018:0112-1 advisory.
Description:	Summary: The remote host is missing an update for the 'openssl' package(s) announced via the SUSE-SU-2018:0112-1 advisory. Vulnerability Insight: This update for openssl fixes the following issues: Security issues fixed: - CVE-2016-7056: ECSDA P-256 timing attack key recovery (bsc#1019334) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085) - CVE-2016-8610: remote denial of service in SSL alert handling (bsc#1005878) - CVE-2017-3735: Malformed X.509 IPAdressFamily could cause OOB read (bsc#1056058) Bug fixes: - support alternate root ca chains (bsc#1032261) - X509_get_default_cert_file() returns an incorrect path (bsc#1022271) - Segmentation fault in 'openssl speed' when engine library file cannot be found (bsc#1000677) - adjust DEFAULT_SUSE to meet 1.0.2 and current state (bsc#1027908) - Missing important ciphers in openssl 1.0.1i-47.1 on SLES12 SP1 (bsc#990592) - out of bounds read+crash in DES_fcrypt (bsc#1065363) - tracker bug for January 26th 2017 release (bsc#1021641) - patch for CVE-2016-2108 fails negative zero exploit (bsc#1001502) - Birthday attacks on 64-bit block ciphers aka triple-des (SWEET32) (bsc#1001912) - Include additional patch for CVE-2016-2108 (bsc#1004499) - openssl DEFAULT_SUSE cipher list is missing ECDHE-ECDSA ciphers (bsc#1055825) Affected Software/OS: 'openssl' package(s) on SUSE Linux Enterprise Server 12. Solution: Please install the updated package(s). CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-2108 http://lists.apple.com/archives/security-announce/2016/Jul/msg00000.html BugTraq ID: 89752 http://www.securityfocus.com/bid/89752 BugTraq ID: 91787 http://www.securityfocus.com/bid/91787 Cisco Security Advisory: 20160504 Multiple Vulnerabilities in OpenSSL Affecting Cisco Products: May 2016 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl Debian Security Information: DSA-3566 (Google Search) http://www.debian.org/security/2016/dsa-3566 http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183457.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183607.html http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184605.html https://security.gentoo.org/glsa/201612-16 http://packetstormsecurity.com/files/136912/Slackware-Security-Advisory-openssl-Updates.html RedHat Security Advisories: RHSA-2016:0722 http://rhn.redhat.com/errata/RHSA-2016-0722.html RedHat Security Advisories: RHSA-2016:0996 http://rhn.redhat.com/errata/RHSA-2016-0996.html RedHat Security Advisories: RHSA-2016:1137 https://access.redhat.com/errata/RHSA-2016:1137 RedHat Security Advisories: RHSA-2016:2056 http://rhn.redhat.com/errata/RHSA-2016-2056.html RedHat Security Advisories: RHSA-2016:2073 http://rhn.redhat.com/errata/RHSA-2016-2073.html RedHat Security Advisories: RHSA-2016:2957 http://rhn.redhat.com/errata/RHSA-2016-2957.html RedHat Security Advisories: RHSA-2017:0193 https://access.redhat.com/errata/RHSA-2017:0193 RedHat Security Advisories: RHSA-2017:0194 https://access.redhat.com/errata/RHSA-2017:0194 http://www.securitytracker.com/id/1035721 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.542103 SuSE Security Announcement: SUSE-SU-2016:1206 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00001.html SuSE Security Announcement: SUSE-SU-2016:1228 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00008.html SuSE Security Announcement: SUSE-SU-2016:1231 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00010.html SuSE Security Announcement: SUSE-SU-2016:1233 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00011.html SuSE Security Announcement: SUSE-SU-2016:1267 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00029.html SuSE Security Announcement: SUSE-SU-2016:1290 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00036.html SuSE Security Announcement: SUSE-SU-2016:1360 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00055.html SuSE Security Announcement: openSUSE-SU-2016:1237 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00013.html SuSE Security Announcement: openSUSE-SU-2016:1238 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00014.html SuSE Security Announcement: openSUSE-SU-2016:1239 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00015.html SuSE Security Announcement: openSUSE-SU-2016:1240 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00016.html SuSE Security Announcement: openSUSE-SU-2016:1241 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00017.html SuSE Security Announcement: openSUSE-SU-2016:1242 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00018.html SuSE Security Announcement: openSUSE-SU-2016:1243 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00019.html SuSE Security Announcement: openSUSE-SU-2016:1273 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00030.html http://www.ubuntu.com/usn/USN-2959-1 Common Vulnerability Exposure (CVE) ID: CVE-2016-7056 1037575 http://www.securitytracker.com/id/1037575 95375 http://www.securityfocus.com/bid/95375 DSA-3773 https://www.debian.org/security/2017/dsa-3773 RHSA-2017:1413 https://access.redhat.com/errata/RHSA-2017:1413 RHSA-2017:1414 https://access.redhat.com/errata/RHSA-2017:1414 RHSA-2017:1415 http://rhn.redhat.com/errata/RHSA-2017-1415.html RHSA-2017:1801 https://access.redhat.com/errata/RHSA-2017:1801 RHSA-2017:1802 https://access.redhat.com/errata/RHSA-2017:1802 [oss-security] 20170110 CVE-2016-7056 ECDSA P-256 timing attack key recovery (OpenSSL, LibreSSL, BoringSSL) https://seclists.org/oss-sec/2017/q1/52 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7056 https://eprint.iacr.org/2016/1195 https://ftp.openbsd.org/pub/OpenBSD/patches/5.9/common/033_libcrypto.patch.sig https://ftp.openbsd.org/pub/OpenBSD/patches/6.0/common/016_libcrypto.patch.sig https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=8aed2a7548362e88e84a7feb795a3a97e8395008 https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-7056.html https://security-tracker.debian.org/tracker/CVE-2016-7056 Common Vulnerability Exposure (CVE) ID: CVE-2016-8610 1037084 http://www.securitytracker.com/id/1037084 93841 http://www.securityfocus.com/bid/93841 FreeBSD-SA-16:35 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:35.openssl.asc RHSA-2017:0286 http://rhn.redhat.com/errata/RHSA-2017-0286.html RHSA-2017:0574 http://rhn.redhat.com/errata/RHSA-2017-0574.html RHSA-2017:1658 https://access.redhat.com/errata/RHSA-2017:1658 RHSA-2017:1659 http://rhn.redhat.com/errata/RHSA-2017-1659.html RHSA-2017:2493 https://access.redhat.com/errata/RHSA-2017:2493 RHSA-2017:2494 https://access.redhat.com/errata/RHSA-2017:2494 [oss-security] 20161024 CVE-2016-8610: SSL Death Alert: OpenSSL SSL/TLS SSL3_AL_WARNING undefined alert Remote DoS http://seclists.org/oss-sec/2016/q4/224 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401 https://security.360.cn/cve/CVE-2016-8610/ https://security.netapp.com/advisory/ntap-20171130-0001/ https://security.paloaltonetworks.com/CVE-2016-8610 https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us https://www.oracle.com/security-alerts/cpuapr2020.html https://www.oracle.com/security-alerts/cpujan2020.html https://www.oracle.com/security-alerts/cpujul2020.html https://www.oracle.com/security-alerts/cpuoct2020.html https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html Common Vulnerability Exposure (CVE) ID: CVE-2017-3731 BugTraq ID: 95813 http://www.securityfocus.com/bid/95813 Debian Security Information: DSA-3773 (Google Search) http://www.debian.org/security/2017/dsa-3773 FreeBSD Security Advisory: FreeBSD-SA-17:11 https://security.FreeBSD.org/advisories/FreeBSD-SA-17:02.openssl.asc https://security.gentoo.org/glsa/201702-07 https://github.com/openssl/openssl/commit/00d965474b22b54e4275232bc71ee0c699c5cd21 https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html RedHat Security Advisories: RHSA-2017:0286 RedHat Security Advisories: RHSA-2018:2185 https://access.redhat.com/errata/RHSA-2018:2185 RedHat Security Advisories: RHSA-2018:2186 https://access.redhat.com/errata/RHSA-2018:2186 RedHat Security Advisories: RHSA-2018:2187 https://access.redhat.com/errata/RHSA-2018:2187 http://www.securitytracker.com/id/1037717 Common Vulnerability Exposure (CVE) ID: CVE-2017-3735 BugTraq ID: 100515 http://www.securityfocus.com/bid/100515 http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html https://security.netapp.com/advisory/ntap-20170927-0001/ https://security.netapp.com/advisory/ntap-20171107-0002/ https://support.apple.com/HT208331 https://www.openssl.org/news/secadv/20170828.txt https://www.openssl.org/news/secadv/20171102.txt https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html https://www.tenable.com/security/tns-2017-14 https://www.tenable.com/security/tns-2017-15 Debian Security Information: DSA-4017 (Google Search) https://www.debian.org/security/2017/dsa-4017 Debian Security Information: DSA-4018 (Google Search) https://www.debian.org/security/2017/dsa-4018 https://security.FreeBSD.org/advisories/FreeBSD-SA-17:11.openssl.asc https://security.gentoo.org/glsa/201712-03 https://github.com/openssl/openssl/commit/068b963bb7afc57f5bdd723de0dd15e7795d5822 https://www.oracle.com//security-alerts/cpujul2021.html https://lists.debian.org/debian-lts-announce/2017/11/msg00011.html RedHat Security Advisories: RHSA-2018:3221 https://access.redhat.com/errata/RHSA-2018:3221 RedHat Security Advisories: RHSA-2018:3505 https://access.redhat.com/errata/RHSA-2018:3505 http://www.securitytracker.com/id/1039726 https://usn.ubuntu.com/3611-2/
Copyright	Copyright (C) 2021 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.