| Description: | Summary:
The remote host is missing an update for the 'OpenSSL' package(s) announced via the SUSE-SU-2014:0761-1 advisory.
Vulnerability Insight:
OpenSSL was updated to fix several vulnerabilities:
* SSL/TLS MITM vulnerability. (CVE-2014-0224)
* DTLS recursion flaw. (CVE-2014-0221)
* Anonymous ECDH denial of service. (CVE-2014-3470)
* Using the FLUSH+RELOAD Cache Side-channel Attack the nonces could
have been recovered. (CVE-2014-0076)
Further information can be found at [link moved to references] .
Additionally, the following non-security fixes and enhancements have been included in this release:
* Ensure that the stack is marked non-executable on x86 32bit. On
other processor platforms it was already marked as non-executable
before. (bnc#870192)
* IPv6 support was added to the openssl s_client and s_server command
line tool. (bnc#859228)
* The openssl command line tool now checks certificates by default
against /etc/ssl/certs (this can be changed via the -CApath option).
(bnc#860332)
* The Elliptic Curve Diffie-Hellman key exchange selector was enabled
and can be selected by kECDHE, kECDH, ECDH tags in the SSL cipher
string. (bnc#859924)
* If an optional openssl1 command line tool is installed in parallel,
c_rehash uses it to generate certificate hashes in both OpenSSL 0
and OpenSSL 1 style. This allows parallel usage of OpenSSL 0.9.8j
and OpenSSL 1.x client libraries with a shared certificate store.
(bnc#862181)
Security Issues references:
* CVE-2014-0224
* CVE-2014-0221
* CVE-2014-3470
* CVE-2014-0076
Affected Software/OS:
'OpenSSL' package(s) on SUSE Linux Enterprise Server 11 SP1, SUSE Linux Enterprise Server 11 SP2.
Solution:
Please install the updated package(s).
CVSS Score:
5.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:N
|
