SB2018090306 - OpenSUSE Linux update for libressl 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018090306

SB2018090306 - OpenSUSE Linux update for libressl

Published: September 3, 2018

Security Bulletin ID SB2018090306
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Memory-cache side-channel timing attack (CVE-ID: CVE-2018-12434)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to information leak via memory caches when modular addition calculations may not run in constant time when private keys are used to generate Elliptic Curve Digital Signature Algorithm (ECDSA) or Digital Signature Algorithm (DSA) signatures. A local attacker can conduct memory-cache side-channel timing attacks and recover sensitive information, such as the ECDSA or DSA private keys used to generate the signatures, which could be used to conduct additional attacks.


Remediation

Install update from vendor's website.

References