Summary
[1.0.2k-12.0.3]
- Oracle bug 28672370: backport CVE-2018-0732
- Oracle bug 28672351: backport CVE-2018-0737
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | openssl | 1:1.0.2k-12.0.3.el7 |
| Oracle Linux · 7 | openssl-devel | 1:1.0.2k-12.0.3.el7 |
| Oracle Linux · 7 | openssl-libs | 1:1.0.2k-12.0.3.el7 |
| Oracle Linux · 7 | openssl-perl | 1:1.0.2k-12.0.3.el7 |
| Oracle Linux · 7 | openssl-static | 1:1.0.2k-12.0.3.el7 |
Vulnerabilities 2
-
Unscored —CVE-2018-0732 EPSS 47%
Client DoS due to large DH parameter
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a …
-
Unscored —CVE-2018-0737 EPSS 12%
Cache timing vulnerability in RSA Key Generation
The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. Fixed in Open…