安全公告/【CVE-2018-0737】

基本信息

漏洞名称:
受影响操作系统:红旗Asianux服务器操作系统 V8
危险等级:中危
影响源码包:shim
CVSS评分:5.9
发现日期:2024-10-15
修复日期:2024-10-15
修复版本:

漏洞描述

OpenSSL RSA 密钥生成算法已被证实易受缓存计时侧信道攻击。在 RSA 密钥生成过程中，具有足够权限发起缓存计时攻击的攻击者可以恢复私钥。已在 OpenSSL 1.1.0i-dev 中修复（受影响的版本为 1.1.0-1.1.0h）。已在 OpenSSL 1.0.2p-dev 中修复（受影响的版本为 1.0.2b-1.0.2o）。

漏洞判定


        

        

            
修复方式

            
软件包升级
dnf update shim


        

  
        

            
补丁

            

        

        

            
参考

            

                                https://www.openssl.org/news/secadv/20180416.txt

                                http://www.securitytracker.com/id/1040685

                                http://www.securityfocus.com/bid/103766

                                https://usn.ubuntu.com/3628-2/

                                https://usn.ubuntu.com/3628-1/

                                https://usn.ubuntu.com/3692-2/

                                https://usn.ubuntu.com/3692-1/

                                https://security.netapp.com/advisory/ntap-20180726-0003/

                                https://lists.debian.org/debian-lts-announce/2018/07/msg00043.html

                                https://nodejs.org/en/blog/vulnerability/august-2018-security-releases/

                                https://www.tenable.com/security/tns-2018-12

                                https://securityadvisories.paloaltonetworks.com/Home/Detail/133

                                http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html

                                https://www.tenable.com/security/tns-2018-14

                                https://www.tenable.com/security/tns-2018-13

                                https://access.redhat.com/errata/RHSA-2018:3221

                                https://access.redhat.com/errata/RHSA-2018:3505

                                https://security.gentoo.org/glsa/201811-21

                                https://www.debian.org/security/2018/dsa-4348

                                https://www.debian.org/security/2018/dsa-4355

                                https://www.tenable.com/security/tns-2018-17

                                https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

                                https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

                                https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

                                https://access.redhat.com/errata/RHSA-2019:3935

                                https://access.redhat.com/errata/RHSA-2019:3933

                                https://access.redhat.com/errata/RHSA-2019:3932

                                https://www.oracle.com/security-alerts/cpuapr2020.html

                                https://www.oracle.com//security-alerts/cpujul2021.html

                                https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/

                                https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/

                                https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/

                                https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=349a41da1ad88ad87825414752a8ff5fdd6a6c3f

                                https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=6939eab03a6e23d2bd2c3f5e34fe1d48e542e787