SB2018110102 - Information disclosure in OpenSSL

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2018-0735)

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to disclosure of the OpenSSL ECDSA signature algorithm. A remote attacker can use variations in the signing algorithm to conduct a timing side channel attack and recover the private key.

2) Information disclosure (CVE-ID: CVE-2018-0734)

The vulnerability allows a local attacker to obtain potentially sensitive information.

The vulnerability exists due to unspecified flaw in Digital Signature Algorithm (DSA). A local attacker can conduct a timing side-channel attack and recover the private key, which could be used to conduct further attacks.

Remediation

Install update from vendor's website.

References

• https://www.openssl.org/news/secadv/20181029.txt
• https://www.openssl.org/news/secadv/20181030.txt