PT-2018-11170 · Openssl Project The Openbsd+2 · Libressl+2

Keegan Ryan

·

Publicado

2018-06-14

·

Atualizado

2024-06-15

·

CVE-2018-12434

CVSS v3.1

4.7

Média

VetorAV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions LibreSSL versions prior to 2.6.5 LibreSSL versions 2.7.x prior to 2.7.4
Description The issue allows for a memory-cache side-channel attack on DSA and ECDSA signatures. This is also known as the Return Of the Hidden Number Problem or ROHNP. To exploit this, an attacker would need access to either the local machine or a different virtual machine on the same physical host.
Recommendations For LibreSSL versions prior to 2.6.5, update to version 2.6.5 or later. For LibreSSL versions 2.7.x prior to 2.7.4, update to version 2.7.4 or later.

Correção

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2018-2116
CVE-2018-12434
OPENSUSE-SU-2018_2592-1
OPENSUSE-SU-2018_2597-1
OPENSUSE-SU-2024:10985-1

Produtos afetados

Alt Linux
Libressl
Suse