Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Debian · 9 | openssl1.0 | 1.0.2q-1~deb9u1 |
Vulnerabilities 4
-
Unscored —CVE-2018-0732 EPSS 47%
Client DoS due to large DH parameter
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a …
-
Unscored —CVE-2018-0734 EPSS 12%
Timing attack against DSA
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affec…
-
Unscored —CVE-2018-0737 EPSS 12%
Cache timing vulnerability in RSA Key Generation
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in Open…
-
Unscored —CVE-2018-5407 Public exploit
Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attack…