Skip to content
OpenAdvisories
Unscored RHSA-2019:3700 3 CVEs

Red Hat Security Advisory: openssl security, bug fix, and enhancement update

Published Sep 16, 2024 · Updated Sep 21, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl 1:1.1.1c-2.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-debuginfo 1:1.1.1c-2.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-debugsource 1:1.1.1c-2.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-devel 1:1.1.1c-2.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-libs 1:1.1.1c-2.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-libs-debuginfo 1:1.1.1c-2.el8
Red Hat · RHEL 8 enterprise_linux:8::baseos openssl-perl 1:1.1.1c-2.el8

Vulnerabilities 3

  • Unscored —
    CVE-2018-0734 EPSS 12%

    Timing attack against DSA

    The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affec…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-0735

    Timing attack against ECDSA signature generation

    The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-1543

    ChaCha20-Poly1305 with long nonces

    ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if i…

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1644356
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1644364
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1668880
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1686058
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1686548
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1695954
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1697915
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1706104
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1706915
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1712023
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1714245
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3700.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-0734
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-0734
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-0734
  • report
    https://access.redhat.com/security/cve/CVE-2018-0735
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-0735
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-0735
  • report
    https://access.redhat.com/security/cve/CVE-2019-1543
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-1543
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-1543