Описание
Уязвимость библиотеки OpenSSL связана с ошибками обработки криптографических ключей при использовании протокола DH (E). Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании
Вендор
Canonical Ltd.
ООО «РусБИТех-Астра»
Oracle Corp.
Red Hat Inc.
Сообщество свободного программного обеспечения
Novell Inc.
OpenSSL Software Foundation
Fedora Project
Node.js Foundation
IBM Corp.
ООО «Ред Софт»
Juniper Networks Inc.
ООО «Открытая мобильная платформа»
Наименование ПО
Ubuntu
Astra Linux Special Edition
API Gateway
Red Hat Enterprise Linux
Debian GNU/Linux
OpenSUSE Leap
Enterprise Manager Ops Center
JD Edwards EnterpriseOne Tools
OpenSSL
VM VirtualBox
Tuxedo
PeopleSoft Enterprise PeopleTools
Primavera P6 Enterprise Project Portfolio Management
Suse Linux Enterprise Desktop
SUSE Enterprise Storage
SUSE Linux Enterprise Software Development Kit
SUSE OpenStack Cloud
Suse Linux Enterprise Server
Fedora
Node.js
SUSE Linux Enterprise Module for Web Scripting
Communications WebRTC Session Controller
Communications Application Session Controller
Agile Engineering Data Management
Enterprise Manager Base Platform
Endeca Server
Communications EAGLE LNP Application Processor
Communications Operations Monitor
Communications Session Border Controller
Communications Unified Session Manager
Enterprise Communications Broker
Enterprise Session Border Controller
JD Edwards World Security
MySQL Workbench
OSS Support Tools
SUSE Linux Enterprise Module for Basesystem
SUSE Studio Onsite
SUSE Linux Enterprise Point of Sale
SUSE CaaS Platform
SUSE Linux Enterprise Module for Legacy Software
OpenStack Cloud Magnum Orchestration
Fujitsu M10-1
Fujitsu M10-4
Fujitsu M10-4S
Fujitsu M12-1
Fujitsu M12-2
Fujitsu M12-2S
JBoss Core Services
РЕД ОС
SUSE Linux Enterprise High Performance Computing
Astra Linux Special Edition для «Эльбрус»
Communications Performance Intelligence Center (PIC) Software
Junos Space
ОС Аврора
Версия ПО
14.04 LTS (Ubuntu)
1.5 «Смоленск» (Astra Linux Special Edition)
11.1.2.4.0 (API Gateway)
7 (Red Hat Enterprise Linux)
16.04 LTS (Ubuntu)
9 (Debian GNU/Linux)
42.3 (OpenSUSE Leap)
17.10 (Ubuntu)
18.04 LTS (Ubuntu)
12.2.2 (Enterprise Manager Ops Center)
12.3.3 (Enterprise Manager Ops Center)
9.2 (JD Edwards EnterpriseOne Tools)
от 1.1.0 до 1.1.0h включительно (OpenSSL)
до 5.2.20 (VM VirtualBox)
12.1.1.0 (Tuxedo)
8.55 (PeopleSoft Enterprise PeopleTools)
8.56 (PeopleSoft Enterprise PeopleTools)
8.57 (PeopleSoft Enterprise PeopleTools)
1.6 «Смоленск» (Astra Linux Special Edition)
от 1.0.2 до 1.0.2o включительно (OpenSSL)
8.4 (Primavera P6 Enterprise Project Portfolio Management)
15.1 (Primavera P6 Enterprise Project Portfolio Management)
15.2 (Primavera P6 Enterprise Project Portfolio Management)
16.1 (Primavera P6 Enterprise Project Portfolio Management)
16.2 (Primavera P6 Enterprise Project Portfolio Management)
18.8 (Primavera P6 Enterprise Project Portfolio Management)
от 17.7 до 17.12 (Primavera P6 Enterprise Project Portfolio Management)
12 SP3 (Suse Linux Enterprise Desktop)
12 SP4 (Suse Linux Enterprise Desktop)
4 (SUSE Enterprise Storage)
12 SP3 (SUSE Linux Enterprise Software Development Kit)
12 SP4 (SUSE Linux Enterprise Software Development Kit)
7 (SUSE OpenStack Cloud)
8.0 (Debian GNU/Linux)
12 SP3 (Suse Linux Enterprise Server)
12 SP4 (Suse Linux Enterprise Server)
11 SP3 LTSS (Suse Linux Enterprise Server)
11 SP4 (Suse Linux Enterprise Server)
11 SP4 (SUSE Linux Enterprise Software Development Kit)
29 (Fedora)
12.04 ESM (Ubuntu)
10 (Node.js)
11 (Node.js)
12 (SUSE Linux Enterprise Module for Web Scripting)
до 7.2 (Communications WebRTC Session Controller)
3.7.1 (Communications Application Session Controller)
3.8.0 (Communications Application Session Controller)
6.1.3 (Agile Engineering Data Management)
6.2.0 (Agile Engineering Data Management)
6.2.1 (Agile Engineering Data Management)
12.1.0.5 (Enterprise Manager Base Platform)
7.7.0 (Endeca Server)
6 (Node.js)
8 (Node.js)
10.0 (Communications EAGLE LNP Application Processor)
10.1 (Communications EAGLE LNP Application Processor)
10.2 (Communications EAGLE LNP Application Processor)
3.4 (Communications Operations Monitor)
4.0 (Communications Operations Monitor)
SCz7.4.0 (Communications Session Border Controller)
SCz7.4.1 (Communications Session Border Controller)
SCz8.0.0 (Communications Session Border Controller)
SCz8.1.0 (Communications Session Border Controller)
SCz7.3.5 (Communications Unified Session Manager)
PCz2.1 (Enterprise Communications Broker)
PCz2.2 (Enterprise Communications Broker)
PCz3.0 (Enterprise Communications Broker)
ECz7.4.0 (Enterprise Session Border Controller)
ECz7.5.0 (Enterprise Session Border Controller)
ECz8.0.0 (Enterprise Session Border Controller)
ECz8.1.0 (Enterprise Session Border Controller)
13.2.0 (Enterprise Manager Base Platform)
13.3.0 (Enterprise Manager Base Platform)
A9.3 (JD Edwards World Security)
A9.3.1 (JD Edwards World Security)
A9.4 (JD Edwards World Security)
до 8.0.13 включительно (MySQL Workbench)
до 19.1 (OSS Support Tools)
15 (SUSE Linux Enterprise Module for Basesystem)
15 SP1 (SUSE Linux Enterprise Module for Basesystem)
15.0 (OpenSUSE Leap)
1.3 (SUSE Studio Onsite)
12 SP2-CLIENT (SUSE Linux Enterprise Point of Sale)
12 SP2-BCL (Suse Linux Enterprise Server)
12 SP2-ESPOS (Suse Linux Enterprise Server)
- (SUSE CaaS Platform)
15 SP1 (SUSE Linux Enterprise Module for Legacy Software)
15 (SUSE Linux Enterprise Module for Legacy Software)
11 SP3 (SUSE Linux Enterprise Point of Sale)
12-LTSS (Suse Linux Enterprise Server)
11 SP4-LTSS (Suse Linux Enterprise Server)
12 SP1-LTSS (Suse Linux Enterprise Server)
12 SP2-LTSS (Suse Linux Enterprise Server)
30 (Fedora)
12 SP5 (Suse Linux Enterprise Server)
12 SP5 (SUSE Linux Enterprise Software Development Kit)
8 (Debian GNU/Linux)
15 (SUSE Linux Enterprise Module for Web Scripting)
15 SP1 (SUSE Linux Enterprise Module for Web Scripting)
Crowbar 8 (SUSE OpenStack Cloud)
7 (OpenStack Cloud Magnum Orchestration)
12 (SUSE Linux Enterprise Module for Legacy Software)
11-SECURITY (Suse Linux Enterprise Server)
31 (Fedora)
12 SP2 (Suse Linux Enterprise Server)
до XCP2361 (Fujitsu M10-1)
до XCP3070 (Fujitsu M10-1)
до XCP2361 (Fujitsu M10-4)
до XCP3070 (Fujitsu M10-4)
до XCP2361 (Fujitsu M10-4S)
до XCP3070 (Fujitsu M10-4S)
до XCP2361 (Fujitsu M12-1)
до XCP3070 (Fujitsu M12-1)
до XCP3070 (Fujitsu M12-2)
до XCP2361 (Fujitsu M12-2)
до XCP2361 (Fujitsu M12-2S)
до XCP3070 (Fujitsu M12-2S)
- (JBoss Core Services)
до 7.2 Муром (РЕД ОС)
12 SP5 (SUSE Linux Enterprise High Performance Computing)
8.1 «Ленинград» (Astra Linux Special Edition для «Эльбрус»)
12 SP1 (Suse Linux Enterprise Server)
10.4.0.2 (Communications Performance Intelligence Center (PIC) Software)
до 21.1R1 (Junos Space)
до 3.2.3.31 (ОС Аврора)
до 3.2.3.31 (ОС Аврора)
до 3.2.3.31 (ОС Аврора)
до 3.2.3.31 (ОС Аврора)
Тип ПО
Операционная система
ПО программно-аппаратных средств защиты
Сетевое программное средство
Прикладное ПО информационных систем
Программное средство защиты
ПО сетевого программно-аппаратного средства
Операционные системы и аппаратные платформы
Canonical Ltd. Ubuntu 14.04 LTS
ООО «РусБИТех-Астра» Astra Linux Special Edition 1.5 «Смоленск»
Red Hat Inc. Red Hat Enterprise Linux 7
Canonical Ltd. Ubuntu 16.04 LTS
Сообщество свободного программного обеспечения Debian GNU/Linux 9
Novell Inc. OpenSUSE Leap 42.3
Canonical Ltd. Ubuntu 17.10
Canonical Ltd. Ubuntu 18.04 LTS
ООО «РусБИТех-Астра» Astra Linux Special Edition 1.6 «Смоленск»
Novell Inc. Suse Linux Enterprise Desktop 12 SP3
Novell Inc. Suse Linux Enterprise Desktop 12 SP4
Сообщество свободного программного обеспечения Debian GNU/Linux 8.0
Novell Inc. Suse Linux Enterprise Server 12 SP3
Novell Inc. Suse Linux Enterprise Server 12 SP4
Novell Inc. Suse Linux Enterprise Server 11 SP3 LTSS
Novell Inc. Suse Linux Enterprise Server 11 SP4
Fedora Project Fedora 29
Canonical Ltd. Ubuntu 12.04 ESM
Novell Inc. OpenSUSE Leap 15.0
Novell Inc. Suse Linux Enterprise Server 12 SP2-BCL
Novell Inc. Suse Linux Enterprise Server 12 SP2-ESPOS
Novell Inc. Suse Linux Enterprise Server 12-LTSS
Novell Inc. Suse Linux Enterprise Server 11 SP4-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP1-LTSS
Novell Inc. Suse Linux Enterprise Server 12 SP2-LTSS
Fedora Project Fedora 30
Novell Inc. Suse Linux Enterprise Server 12 SP5
Сообщество свободного программного обеспечения Debian GNU/Linux 8
Novell Inc. Suse Linux Enterprise Server 11-SECURITY
Fedora Project Fedora 31
Novell Inc. Suse Linux Enterprise Server 12 SP2
ООО «Ред Софт» РЕД ОС до 7.2 Муром
ООО «РусБИТех-Астра» Astra Linux Special Edition для «Эльбрус» 8.1 «Ленинград»
Novell Inc. Suse Linux Enterprise Server 12 SP1
ООО «Открытая мобильная платформа» ОС Аврора до 3.2.3.31
ООО «Открытая мобильная платформа» ОС Аврора до 3.2.3.31
ООО «Открытая мобильная платформа» ОС Аврора до 3.2.3.31
ООО «Открытая мобильная платформа» ОС Аврора до 3.2.3.31
Уровень опасности уязвимости
Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,8)
Высокий уровень опасности (базовая оценка CVSS 3.0 составляет 7,5)
Возможные меры по устранению уязвимости
Использование рекомендаций:
Для OpenSSL:
https://www.openssl.org/news/secadv/20180612.txt
Для программных продуктов Oracle:
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
https://www.oracle.com/security-alerts/cpuoct2019.html
https://www.oracle.com/security-alerts/cpuapr2019.html
https://www.oracle.com/security-alerts/cpujan2019.html
https://www.oracle.com/security-alerts/cpujul2019.html
https://www.oracle.com/security-alerts/cpuoct2018.html
https://www.oracle.com/security-alerts/cpujan2021.html
Для Debian:
https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html
https://www.debian.org/security/2018/dsa-4348
https://www.debian.org/security/2018/dsa-4355
Для Ubuntu:
https://usn.ubuntu.com/3692-1/
https://usn.ubuntu.com/3692-2/
Для Red Hat:
https://access.redhat.com/security/cve/CVE-2018-0732
Для Fedora:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/
Для Astra Linux:
Обновление программного обеспечения (пакета openssl) до 1.0.1t-1+deb8u9 или более поздней версии
Обновление программного обеспечения (пакета openssl) до 1.0.2q-1~deb9u1 или более поздней версии
Для РЕД ОС:
Обновление операционной системы до версии 7.2 Муром
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2018-0732/
Для Astra Linux:
https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16
Для ОС Аврора 3.2.1:
https://cve.omprussia.ru/bb4321
Для ОС Аврора 3.2.2:
https://cve.omprussia.ru/bb5322
Для ОС Аврора 3.2.3:
https://cve.omprussia.ru/bb6323
Для продуктов Juniper Networks :
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA11176&cat=SIRT_1&actp=LIST&showDraft=false
Статус уязвимости
Подтверждена производителем
Наличие эксплойта
Данные уточняются
Информация об устранении
Уязвимость устранена
Ссылки на источники
Идентификаторы других систем описаний уязвимостей
- CVE
EPSS
Процентиль: 99%
0.81092
Высокий
7.5 High
CVSS3
7.8 High
CVSS2
Связанные уязвимости
CVSS3: 7.5
ubuntu
около 7 лет назад
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
CVSS3: 4.3
redhat
около 7 лет назад
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
CVSS3: 7.5
nvd
около 7 лет назад
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
CVSS3: 7.5
debian
около 7 лет назад
During key agreement in a TLS handshake using a DH(E) based ciphersuit ...
EPSS
Процентиль: 99%
0.81092
Высокий
7.5 High
CVSS3
7.8 High
CVSS2