Vulnerabilities > CVE-2016-8610 - Resource Exhaustion vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
HIGH

Summary

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

Vulnerable Configurations

Part Description Count
Application
Openssl
16
Application
Redhat
2
Application
Netapp
21
Application
Oracle
29
OS
Debian
1
OS
Redhat
17
OS
Netapp
2
OS
Paloaltonetworks
146
OS
Fujitsu
18
Hardware
Netapp
1
Hardware
Fujitsu
6

Common Attack Pattern Enumeration and Classification (CAPEC)

  • XML Ping of the Death
    An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
  • XML Entity Expansion
    An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.
  • Inducing Account Lockout
    An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.
  • Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))
    XML Denial of Service (XDoS) can be applied to any technology that utilizes XML data. This is, of course, most distributed systems technology including Java, .Net, databases, and so on. XDoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious XML payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. The main weakness in XDoS is that the service provider generally must inspect, parse, and validate the XML messages to determine routing, workflow, security considerations, and so on. It is exactly these inspection, parsing, and validation routines that XDoS targets. There are three primary attack vectors that XDoS can navigate Target CPU through recursion: attacker creates a recursive payload and sends to service provider Target memory through jumbo payloads: service provider uses DOM to parse XML. DOM creates in memory representation of XML document, but when document is very large (for example, north of 1 Gb) service provider host may exhaust memory trying to build memory objects. XML Ping of death: attack service provider with numerous small files that clog the system. All of the above attacks exploit the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends.

Nessus

  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2017-803.NASL
    descriptionAn integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen2020-06-01
    modified2020-06-02
    plugin id97555
    published2017-03-07
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/97555
    titleAmazon Linux AMI : openssl (ALAS-2017-803)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-E853B4144F.NASL
    descriptionMinor upstream release fixing CVE-2016-8610, CVE-2017-3731, CVE-2017-3732. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-02-15
    plugin id97180
    published2017-02-15
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97180
    titleFedora 24 : 1:openssl (2017-e853b4144f)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2018-1529.NASL
    descriptionThis update for compat-openssl098 fixes the following issues : Security issues fixed : - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). - CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018). - Fixed the
    last seen2020-06-05
    modified2018-12-13
    plugin id119641
    published2018-12-13
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119641
    titleopenSUSE Security Update : compat-openssl098 (openSUSE-2018-1529)
  • NASL familyFirewalls
    NASL idSCREENOS_JSA10808.NASL
    descriptionThe version of Juniper ScreenOS running on the remote host is 6.3.x prior to 6.3.0r24. It is, therefore, affected by a vulnerability in the way the TLS/SSL protocol specifies processing of ALERT packets during a connection handshake. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id103925
    published2017-10-18
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/103925
    titleJuniper ScreenOS 6.3.x < 6.3.0r24 SSL Death Alert (JSA10808)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1379.NASL
    descriptionAccording to the version of the openssl098e package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients.(CVE-2016-8610) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id119070
    published2018-11-21
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119070
    titleEulerOS Virtualization 2.5.1 : openssl098e (EulerOS-SA-2018-1379)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170321_GNUTLS_ON_SL6_X.NASL
    descriptionThe following packages have been upgraded to a later upstream version: gnutls (2.12.23). Security Fix(es) : - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) - Multiple flaws were found in the way gnutls processed OpenPGP certificates. An attacker could create specially crafted OpenPGP certificates which, when parsed by gnutls, would cause it to crash. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337)
    last seen2020-03-18
    modified2017-04-06
    plugin id99217
    published2017-04-06
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99217
    titleScientific Linux Security Update : gnutls on SL6.x i386/x86_64 (20170321)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0461-1.NASL
    descriptionThis update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed : - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085, CVE-2017-3731) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) Bugs fixed : - fix crash in openssl speed (bsc#1000677) - fix ca-bundle path (bsc#1022271) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id97188
    published2017-02-15
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97188
    titleSUSE SLED12 / SLES12 Security Update : openssl (SUSE-SU-2017:0461-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-814.NASL
    descriptionSeveral vulnerabilities were discovered in OpenSSL : CVE-2016-7056 A local timing attack was discovered against ECDSA P-256. CVE-2016-8610 It was discovered that no limit was imposed on alert packets during an SSL handshake. CVE-2017-3731 Robert Swiecki discovered that the RC4-MD5 cipher when running on 32 bit systems could be forced into an out-of-bounds read, resulting in denial of service. For Debian 7
    last seen2020-03-17
    modified2017-02-02
    plugin id96931
    published2017-02-02
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/96931
    titleDebian DLA-814-1 : openssl security update
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-0574.NASL
    descriptionFrom Red Hat Security Advisory 2017:0574 : An update for gnutls is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. The following packages have been upgraded to a later upstream version: gnutls (2.12.23). (BZ#1321112, BZ#1326073, BZ#1415682, BZ#1326389) Security Fix(es) : * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) * Multiple flaws were found in the way gnutls processed OpenPGP certificates. An attacker could create specially crafted OpenPGP certificates which, when parsed by gnutls, would cause it to crash. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337) Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id99063
    published2017-03-30
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99063
    titleOracle Linux 6 : gnutls (ELSA-2017-0574)
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2017-815.NASL
    descriptionA denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) Multiple flaws were found in the way gnutls processed OpenPGP certificates. An attacker could create specially crafted OpenPGP certificates which, when parsed by gnutls, would cause it to crash. (CVE-2017-5335 , CVE-2017-5336 , CVE-2017-5337)
    last seen2020-06-01
    modified2020-06-02
    plugin id99419
    published2017-04-18
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/99419
    titleAmazon Linux AMI : gnutls (ALAS-2017-815)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0605-1.NASL
    descriptionThis update for compat-openssl098 fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed : - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - degrade 3DES to MEDIUM in SSL2 (bsc#1001912) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) Bugs fixed : - fix crash in openssl speed (bsc#1000677) - don
    last seen2020-06-01
    modified2020-06-02
    plugin id97550
    published2017-03-06
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97550
    titleSUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2017:0605-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0574.NASL
    descriptionAn update for gnutls is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. The following packages have been upgraded to a later upstream version: gnutls (2.12.23). (BZ#1321112, BZ#1326073, BZ#1415682, BZ#1326389) Security Fix(es) : * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) * Multiple flaws were found in the way gnutls processed OpenPGP certificates. An attacker could create specially crafted OpenPGP certificates which, when parsed by gnutls, would cause it to crash. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337) Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id97874
    published2017-03-22
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97874
    titleRHEL 6 : gnutls (RHSA-2017:0574)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-4274-1.NASL
    descriptionThis update for openssl fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018). Fixed the
    last seen2020-03-24
    modified2018-12-28
    plugin id119937
    published2018-12-28
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119937
    titleSUSE SLES11 Security Update : openssl (SUSE-SU-2018:4274-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3181-1.NASL
    descriptionGuido Vranken discovered that OpenSSL used undefined behaviour when performing pointer arithmetic. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS as other releases were fixed in a previous security update. (CVE-2016-2177) It was discovered that OpenSSL did not properly handle Montgomery multiplication, resulting in incorrect results leading to transient failures. This issue only applied to Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7055) It was discovered that OpenSSL did not properly use constant-time operations when performing ECDSA P-256 signing. A remote attacker could possibly use this issue to perform a timing attack and recover private ECDSA keys. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2016-7056) Shi Lei discovered that OpenSSL incorrectly handled certain warning alerts. A remote attacker could possibly use this issue to cause OpenSSL to stop responding, resulting in a denial of service. (CVE-2016-8610) Robert Swiecki discovered that OpenSSL incorrectly handled certain truncated packets. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2017-3731) It was discovered that OpenSSL incorrectly performed the x86_64 Montgomery squaring procedure. While unlikely, a remote attacker could possibly use this issue to recover private keys. This issue only applied to Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2017-3732). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96927
    published2017-02-01
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96927
    titleUbuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : openssl vulnerabilities (USN-3181-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-207.NASL
    descriptionThis update for gnutls fixes the following security issues : - GnuTLS could have crashed when processing maliciously crafted OpenPGP certificates (GNUTLS-SA-2017-2, bsc#1018832, CVE-2017-5335, CVE-2017-5337, CVE-2017-5336) - GnuTLS could have falsely accepted certificates when using OCSP (GNUTLS-SA-2016-3, bsc#999646, CVE-2016-7444) - GnuTLS could have suffered from 100% CPU load DoS attacks by using SSL alert packets during the handshake (bsc#1005879, CVE-2016-8610) This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-05
    modified2017-02-06
    plugin id97004
    published2017-02-06
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/97004
    titleopenSUSE Security Update : gnutls (openSUSE-2017-207)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2017-0286.NASL
    descriptionFrom Red Hat Security Advisory 2017:0286 : An update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen2020-06-01
    modified2020-06-02
    plugin id97293
    published2017-02-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97293
    titleOracle Linux 6 / 7 : openssl (ELSA-2017-0286)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1413.NASL
    descriptionAn update is now available for Red Hat JBoss Core Services on RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user
    last seen2020-06-01
    modified2020-06-02
    plugin id117315
    published2018-09-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117315
    titleRHEL 7 : JBoss Core Services (RHSA-2017:1413)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-0286.NASL
    descriptionAn update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen2020-06-01
    modified2020-06-02
    plugin id97294
    published2017-02-21
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97294
    titleRHEL 6 / 7 : openssl (RHSA-2017:0286)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1030.NASL
    descriptionAccording to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99875
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99875
    titleEulerOS 2.0 SP2 : openssl (EulerOS-SA-2017-1030)
  • NASL familyPalo Alto Local Security Checks
    NASL idPALO_ALTO_PAN-OS_8_0_3.NASL
    descriptionThe version of Palo Alto Networks PAN-OS running on the remote host is 6.1.x prior to 6.1.18, 7.0.x prior to 7.0.17, 7.1.x prior to 7.1.12, or 8.0.x prior to 8.0.3. It is, therefore, affected by multiple vulnerabilities : - A denial of service vulnerability exists in the OpenSSL component that is triggered when handling a large number of consecutive
    last seen2020-06-01
    modified2020-06-02
    plugin id101164
    published2017-06-30
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101164
    titlePalo Alto Networks PAN-OS 6.1.x < 6.1.18 / 7.0.x < 7.0.17 / 7.1.x < 7.1.12 / 8.0.x < 8.0.3 Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-4068-1.NASL
    descriptionThis update for compat-openssl098 fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018). Fixed the
    last seen2020-04-30
    modified2018-12-13
    plugin id119646
    published2018-12-13
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119646
    titleSUSE SLED12 / SLES12 Security Update : compat-openssl098 (SUSE-SU-2018:4068-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-3864-1.NASL
    descriptionThis update for openssl fixes the following issues : Security issues fixed : CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). CVE-2018-0737: Corrected the current error detection of the current fix (bsc#1106197). CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018). Add missing timing side channel patch for DSA signature generation (bsc#1113742). Fixed the
    last seen2020-06-01
    modified2020-06-02
    plugin id119116
    published2018-11-23
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/119116
    titleSUSE SLES12 Security Update : openssl (SUSE-SU-2018:3864-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0348-1.NASL
    descriptionThis update for gnutls fixes the following security issues : - GnuTLS could have crashed when processing maliciously crafted OpenPGP certificates (GNUTLS-SA-2017-2, bsc#1018832, CVE-2017-5335, CVE-2017-5337, CVE-2017-5336) - GnuTLS could have falsely accepted certificates when using OCSP (GNUTLS-SA-2016-3, bsc#999646, CVE-2016-7444) - GnuTLS could have suffered from 100% CPU load DoS attacks by using SSL alert packets during the handshake (bsc#1005879, CVE-2016-8610) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96950
    published2017-02-02
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96950
    titleSUSE SLED12 / SLES12 Security Update : gnutls (SUSE-SU-2017:0348-1)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_0FCD3AF0A0FE11E6B1CF14DAE9D210B8.NASL
    descriptionDue to improper handling of alert packets, OpenSSL would consume an excessive amount of CPU time processing undefined alert messages. Impact : A remote attacker who can initiate handshakes with an OpenSSL based server can cause the server to consume a lot of computation power with very little bandwidth usage, and may be able to use this technique in a leveraged Denial of Service attack.
    last seen2020-06-01
    modified2020-06-02
    plugin id94492
    published2016-11-03
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/94492
    titleFreeBSD : FreeBSD -- OpenSSL Remote DoS vulnerability (0fcd3af0-a0fe-11e6-b1cf-14dae9d210b8)
  • NASL familyOracleVM Local Security Checks
    NASL idORACLEVM_OVMSA-2017-0042.NASL
    descriptionThe remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2017-3731 - DoS via truncated packets with RC4-MD5 cipher - fix CVE-2016-8610 - DoS of single-threaded servers via excessive alerts
    last seen2020-06-01
    modified2020-06-02
    plugin id97316
    published2017-02-22
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97316
    titleOracleVM 3.3 / 3.4 : openssl (OVMSA-2017-0042)
  • NASL familyVirtuozzo Local Security Checks
    NASL idVIRTUOZZO_VZLSA-2017-0286.NASL
    descriptionAn update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id101424
    published2017-07-13
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101424
    titleVirtuozzo 6 : openssl / openssl-devel / openssl-perl / etc (VZLSA-2017-0286)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1801.NASL
    descriptionAn update is now available for Red Hat JBoss Web Server 3.1 for RHEL 6 and Red Hat JBoss Web Server 3.1 for RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library. This release of Red Hat JBoss Web Server 3.1 Service Pack 1 serves as a replacement for Red Hat JBoss Web Server 3.1, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es) : * It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the logger application. (CVE-2017-5645) * A vulnerability was discovered in tomcat
    last seen2020-05-09
    modified2018-08-29
    plugin id112177
    published2018-08-29
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/112177
    titleRHEL 6 / 7 : Red Hat JBoss Web Server 3.1.0 Service Pack 1 (RHSA-2017:1801)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1029.NASL
    descriptionAccording to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99874
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99874
    titleEulerOS 2.0 SP1 : openssl (EulerOS-SA-2017-1029)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1039.NASL
    descriptionAccording to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.(CVE-2016-2182) - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients.(CVE-2016-8610) - A flaw was found in the way malicious SSLv2 clients could negotiate SSLv2 ciphers that were disabled on the server. This could result in weak SSLv2 ciphers being used for SSLv2 connections, making them vulnerable to man-in-the-middle attacks.(CVE-2015-3197) - A padding oracle flaw was found in the Secure Sockets Layer version 2.0 (SSLv2) protocol. An attacker could potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections. This cross-protocol attack is publicly referred to as DROWN.(CVE-2016-0800) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99884
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99884
    titleEulerOS 2.0 SP2 : openssl098e (EulerOS-SA-2017-1039)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1658.NASL
    descriptionAn update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release includes bug fixes as well as a new release of OpenSSL. For further information, see the knowledge base article linked to in the References section. All users of Red Hat JBoss Enterprise Application Platform 6.4 on Red Hat Enterprise Linux 7 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that OpenSSL did not always use constant time operations when computing Digital Signature Algorithm (DSA) signatures. A local attacker could possibly use this flaw to obtain a private DSA key belonging to another user or service running on the same system. (CVE-2016-2178) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) * Multiple integer overflow flaws were found in the way OpenSSL performed pointer arithmetic. A remote attacker could possibly use these flaws to cause a TLS/SSL server or client using OpenSSL to crash. (CVE-2016-2177) Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304.
    last seen2020-06-01
    modified2020-06-02
    plugin id101141
    published2017-06-30
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101141
    titleRHEL 6 / 7 : JBoss EAP (RHSA-2017:1658)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20170220_OPENSSL_ON_SL6_X.NASL
    descriptionSecurity Fix(es) : - An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen2020-03-18
    modified2017-02-21
    plugin id97295
    published2017-02-21
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97295
    titleScientific Linux Security Update : openssl on SL6.x, SL7.x i386/x86_64 (20170220)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2018-0112-1.NASL
    descriptionThis update for openssl fixes the following issues: Security issues fixed : - CVE-2016-7056: ECSDA P-256 timing attack key recovery (bsc#1019334) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085) - CVE-2016-8610: remote denial of service in SSL alert handling (bsc#1005878) - CVE-2017-3735: Malformed X.509 IPAdressFamily could cause OOB read (bsc#1056058) Bug fixes : - support alternate root ca chains (bsc#1032261) - X509_get_default_cert_file() returns an incorrect path (bsc#1022271) - Segmentation fault in
    last seen2020-06-01
    modified2020-06-02
    plugin id106093
    published2018-01-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106093
    titleSUSE SLES12 Security Update : openssl (SUSE-SU-2018:0112-1)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-0286.NASL
    descriptionAn update for openssl is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es) : * An integer underflow leading to an out of bounds read flaw was found in OpenSSL. A remote attacker could possibly use this flaw to crash a 32-bit TLS/SSL server or client using OpenSSL if it used the RC4-MD5 cipher suite. (CVE-2017-3731) * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610)
    last seen2020-06-01
    modified2020-06-02
    plugin id97305
    published2017-02-22
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97305
    titleCentOS 6 / 7 : openssl (CESA-2017:0286)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2017-3451DBEC48.NASL
    descriptionMinor upstream release fixing CVE-2016-8610, CVE-2017-3731, CVE-2017-3732. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-05
    modified2017-02-08
    plugin id97054
    published2017-02-08
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97054
    titleFedora 25 : 1:openssl (2017-3451dbec48)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-1553-1.NASL
    descriptionThis update for openssl fixes the following issues : CVE-2018-0732: Reject excessively large primes in DH key generation (bsc#1097158) CVE-2018-0734: Timing vulnerability in DSA signature generation (bsc#1113652) CVE-2018-0737: Cache timing vulnerability in RSA Key Generation (bsc#1089039) CVE-2018-5407: Elliptic curve scalar multiplication timing attack defenses (fixes
    last seen2020-06-01
    modified2020-06-02
    plugin id126046
    published2019-06-19
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126046
    titleSUSE SLES12 Security Update : openssl (SUSE-SU-2019:1553-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3183-2.NASL
    descriptionUSN-3183-1 fixed CVE-2016-8610 in GnuTLS in Ubuntu 16.04 LTS and Ubuntu 16.10. This update provides the corresponding update for Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. Stefan Buehler discovered that GnuTLS incorrectly verified the serial length of OCSP responses. A remote attacker could possibly use this issue to bypass certain certificate validation measures. This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-7444) Shi Lei discovered that GnuTLS incorrectly handled certain warning alerts. A remote attacker could possibly use this issue to cause GnuTLS to hang, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610) It was discovered that GnuTLS incorrectly decoded X.509 certificates with a Proxy Certificate Information extension. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5334) It was discovered that GnuTLS incorrectly handled certain OpenPGP certificates. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id97853
    published2017-03-21
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97853
    titleUbuntu 12.04 LTS / 14.04 LTS : gnutls26 vulnerability (USN-3183-2)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0304-1.NASL
    descriptionThis update for gnutls fixes the following issues : - Malformed asn1 definitions could cause a segmentation fault in the asn1 definition parser (bsc#961491). - CVE-2016-8610: Remote denial of service in SSL alert handling (bsc#1005879). - CVE-2017-5335: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5336: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). - CVE-2017-5337: Decoding a specially crafted OpenPGP certificate could have lead to heap and stack overflows (bsc#1018832). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96870
    published2017-01-30
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96870
    titleSUSE SLES11 Security Update : gnutls (SUSE-SU-2017:0304-1)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1041.NASL
    descriptionAccording to the version of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients.(CVE-2016-8610) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99886
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99886
    titleEulerOS 2.0 SP2 : gnutls (EulerOS-SA-2017-1041)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2017-0574.NASL
    descriptionAn update for gnutls is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. The following packages have been upgraded to a later upstream version: gnutls (2.12.23). (BZ#1321112, BZ#1326073, BZ#1415682, BZ#1326389) Security Fix(es) : * A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients. (CVE-2016-8610) * Multiple flaws were found in the way gnutls processed OpenPGP certificates. An attacker could create specially crafted OpenPGP certificates which, when parsed by gnutls, would cause it to crash. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337) Additional Changes : For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.9 Release Notes and Red Hat Enterprise Linux 6.9 Technical Notes linked from the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id97951
    published2017-03-27
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97951
    titleCentOS 6 : gnutls (CESA-2017:0574)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-2493.NASL
    descriptionAn update is now available for Red Hat JBoss Enterprise Web Server 2.1.2 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Web Server 2.1.2 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. This release provides an update to OpenSSL and Tomcat 6/7 for Red Hat JBoss Web Server 2.1.2. The updates are documented in the Release Notes document linked to in the References. Users of Red Hat JBoss Web Server 2.1.2 should upgrade to these updated packages, which resolve several security issues. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * A vulnerability was discovered in tomcat
    last seen2020-06-01
    modified2020-06-02
    plugin id102692
    published2017-08-23
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102692
    titleRHEL 6 / 7 : JBoss Web Server (RHSA-2017:2493)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3183-1.NASL
    descriptionStefan Buehler discovered that GnuTLS incorrectly verified the serial length of OCSP responses. A remote attacker could possibly use this issue to bypass certain certificate validation measures. This issue only applied to Ubuntu 16.04 LTS. (CVE-2016-7444) Shi Lei discovered that GnuTLS incorrectly handled certain warning alerts. A remote attacker could possibly use this issue to cause GnuTLS to hang, resulting in a denial of service. This issue has only been addressed in Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8610) It was discovered that GnuTLS incorrectly decoded X.509 certificates with a Proxy Certificate Information extension. A remote attacker could use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2017-5334) It was discovered that GnuTLS incorrectly handled certain OpenPGP certificates. A remote attacker could possibly use this issue to cause GnuTLS to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2017-5335, CVE-2017-5336, CVE-2017-5337). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id96952
    published2017-02-02
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96952
    titleUbuntu 12.04 LTS / 14.04 LTS / 16.04 LTS / 16.10 : gnutls26, gnutls28 vulnerabilities (USN-3183-1)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0109_GNUTLS.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 4.05, has gnutls packages installed that are affected by multiple vulnerabilities: - Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate. (CVE-2017-5336) - The stream reading functions in lib/opencdk/read- packet.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to cause a denial of service (out-of-memory error and crash) via a crafted OpenPGP certificate. (CVE-2017-5335) - Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate. (CVE-2017-5337) - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id127344
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127344
    titleNewStart CGSL MAIN 4.05 : gnutls Multiple Vulnerabilities (NS-SA-2019-0109)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1040.NASL
    descriptionAccording to the versions of the openssl098e package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.(CVE-2016-2182) - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients.(CVE-2016-8610) - A flaw was found in the way malicious SSLv2 clients could negotiate SSLv2 ciphers that were disabled on the server. This could result in weak SSLv2 ciphers being used for SSLv2 connections, making them vulnerable to man-in-the-middle attacks.(CVE-2015-3197) - A padding oracle flaw was found in the Secure Sockets Layer version 2.0 (SSLv2) protocol. An attacker could potentially use this flaw to decrypt RSA-encrypted cipher text from a connection using a newer SSL/TLS protocol version, allowing them to decrypt such connections. This cross-protocol attack is publicly referred to as DROWN.(CVE-2016-0800) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99885
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99885
    titleEulerOS 2.0 SP1 : openssl098e (EulerOS-SA-2017-1040)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0585-1.NASL
    descriptionThis update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed : - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - degrade 3DES to MEDIUM in SSL2 (bsc#1001912) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) Bugs fixed : - fix crash in openssl speed (bsc#1000677) - don
    last seen2020-06-01
    modified2020-06-02
    plugin id97494
    published2017-03-02
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/97494
    titleSUSE SLES11 Security Update : openssl (SUSE-SU-2017:0585-1)
  • NASL familyAIX Local Security Checks
    NASL idAIX_OPENSSL_ADVISORY22.NASL
    descriptionThe version of OpenSSL installed on the remote AIX host is affected by an error when processing ALERT packets during an SSL handshake. By sending specially-crafted plain-text ALERT packets, a remote attacker can exploit this vulnerability to cause a denial of service.
    last seen2020-06-01
    modified2020-06-02
    plugin id107229
    published2018-03-08
    reporterThis script is Copyright (C) 2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/107229
    titleAIX OpenSSL Advisory : openssl_advisory22.asc
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3773.NASL
    descriptionSeveral vulnerabilities were discovered in OpenSSL : - CVE-2016-7056 A local timing attack was discovered against ECDSA P-256. - CVE-2016-8610 It was discovered that no limit was imposed on alert packets during an SSL handshake. - CVE-2017-3731 Robert Swiecki discovered that the RC4-MD5 cipher when running on 32 bit systems could be forced into an out-of-bounds read, resulting in denial of service.
    last seen2020-06-01
    modified2020-06-02
    plugin id96842
    published2017-01-30
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96842
    titleDebian DSA-3773-1 : openssl - security update
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2017-1042.NASL
    descriptionAccording to the version of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections form other clients.(CVE-2016-8610) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-05-06
    modified2017-05-01
    plugin id99887
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99887
    titleEulerOS 2.0 SP1 : gnutls (EulerOS-SA-2017-1042)
  • NASL familyFirewalls
    NASL idPFSENSE_SA-17_03.NASL
    descriptionAccording to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.
    last seen2020-06-01
    modified2020-06-02
    plugin id106503
    published2018-01-31
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106503
    titlepfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2017-1414.NASL
    descriptionAn update is now available for Red Hat JBoss Core Services on RHEL 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References. Security Fix(es) : * A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304) * It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user
    last seen2020-06-01
    modified2020-06-02
    plugin id117316
    published2018-09-06
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117316
    titleRHEL 6 : JBoss Core Services (RHSA-2017:1414)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2017-255.NASL
    descriptionThis update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed : - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085, CVE-2017-3731) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) Bugs fixed : - fix crash in openssl speed (bsc#1000677) - fix ca-bundle path (bsc#1022271) This update was imported from the SUSE:SLE-12-SP1:Update update project.
    last seen2020-06-05
    modified2017-02-21
    plugin id97275
    published2017-02-21
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/97275
    titleopenSUSE Security Update : openssl (openSUSE-2017-255)

Redhat

advisories
  • rhsa
    idRHSA-2017:0286
  • rhsa
    idRHSA-2017:0574
  • rhsa
    idRHSA-2017:1413
  • rhsa
    idRHSA-2017:1414
  • rhsa
    idRHSA-2017:1415
  • rhsa
    idRHSA-2017:1658
  • rhsa
    idRHSA-2017:1659
  • rhsa
    idRHSA-2017:1801
  • rhsa
    idRHSA-2017:1802
  • rhsa
    idRHSA-2017:2493
  • rhsa
    idRHSA-2017:2494
rpms
  • openssl-0:1.0.1e-48.el6_8.4
  • openssl-1:1.0.1e-60.el7_3.1
  • openssl-debuginfo-0:1.0.1e-48.el6_8.4
  • openssl-debuginfo-1:1.0.1e-60.el7_3.1
  • openssl-devel-0:1.0.1e-48.el6_8.4
  • openssl-devel-1:1.0.1e-60.el7_3.1
  • openssl-libs-1:1.0.1e-60.el7_3.1
  • openssl-perl-0:1.0.1e-48.el6_8.4
  • openssl-perl-1:1.0.1e-60.el7_3.1
  • openssl-static-0:1.0.1e-48.el6_8.4
  • openssl-static-1:1.0.1e-60.el7_3.1
  • gnutls-0:2.12.23-21.el6
  • gnutls-debuginfo-0:2.12.23-21.el6
  • gnutls-devel-0:2.12.23-21.el6
  • gnutls-guile-0:2.12.23-21.el6
  • gnutls-utils-0:2.12.23-21.el6
  • jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7
  • jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7
  • jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7
  • jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7
  • jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7
  • jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7
  • jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7
  • jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7
  • jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7
  • jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7
  • jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7
  • jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7
  • jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7
  • jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6
  • jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6
  • jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6
  • jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6
  • jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6
  • jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6
  • jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6
  • jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6
  • jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6
  • jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6
  • jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6
  • jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6
  • jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6
  • jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7
  • log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el6
  • log4j-eap6-0:1.2.16-12.redhat_3.1.ep6.el7
  • tomcat-native-0:1.2.8-10.redhat_10.ep7.el6
  • tomcat-native-0:1.2.8-10.redhat_10.ep7.el7
  • tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el6
  • tomcat-native-debuginfo-0:1.2.8-10.redhat_10.ep7.el7
  • tomcat7-0:7.0.70-22.ep7.el6
  • tomcat7-0:7.0.70-22.ep7.el7
  • tomcat7-admin-webapps-0:7.0.70-22.ep7.el6
  • tomcat7-admin-webapps-0:7.0.70-22.ep7.el7
  • tomcat7-docs-webapp-0:7.0.70-22.ep7.el6
  • tomcat7-docs-webapp-0:7.0.70-22.ep7.el7
  • tomcat7-el-2.2-api-0:7.0.70-22.ep7.el6
  • tomcat7-el-2.2-api-0:7.0.70-22.ep7.el7
  • tomcat7-javadoc-0:7.0.70-22.ep7.el6
  • tomcat7-javadoc-0:7.0.70-22.ep7.el7
  • tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el6
  • tomcat7-jsp-2.2-api-0:7.0.70-22.ep7.el7
  • tomcat7-jsvc-0:7.0.70-22.ep7.el6
  • tomcat7-jsvc-0:7.0.70-22.ep7.el7
  • tomcat7-lib-0:7.0.70-22.ep7.el6
  • tomcat7-lib-0:7.0.70-22.ep7.el7
  • tomcat7-log4j-0:7.0.70-22.ep7.el6
  • tomcat7-log4j-0:7.0.70-22.ep7.el7
  • tomcat7-selinux-0:7.0.70-22.ep7.el6
  • tomcat7-selinux-0:7.0.70-22.ep7.el7
  • tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el6
  • tomcat7-servlet-3.0-api-0:7.0.70-22.ep7.el7
  • tomcat7-webapps-0:7.0.70-22.ep7.el6
  • tomcat7-webapps-0:7.0.70-22.ep7.el7
  • tomcat8-0:8.0.36-24.ep7.el6
  • tomcat8-0:8.0.36-24.ep7.el7
  • tomcat8-admin-webapps-0:8.0.36-24.ep7.el6
  • tomcat8-admin-webapps-0:8.0.36-24.ep7.el7
  • tomcat8-docs-webapp-0:8.0.36-24.ep7.el6
  • tomcat8-docs-webapp-0:8.0.36-24.ep7.el7
  • tomcat8-el-2.2-api-0:8.0.36-24.ep7.el6
  • tomcat8-el-2.2-api-0:8.0.36-24.ep7.el7
  • tomcat8-javadoc-0:8.0.36-24.ep7.el6
  • tomcat8-javadoc-0:8.0.36-24.ep7.el7
  • tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el6
  • tomcat8-jsp-2.3-api-0:8.0.36-24.ep7.el7
  • tomcat8-jsvc-0:8.0.36-24.ep7.el6
  • tomcat8-jsvc-0:8.0.36-24.ep7.el7
  • tomcat8-lib-0:8.0.36-24.ep7.el6
  • tomcat8-lib-0:8.0.36-24.ep7.el7
  • tomcat8-log4j-0:8.0.36-24.ep7.el6
  • tomcat8-log4j-0:8.0.36-24.ep7.el7
  • tomcat8-selinux-0:8.0.36-24.ep7.el6
  • tomcat8-selinux-0:8.0.36-24.ep7.el7
  • tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el6
  • tomcat8-servlet-3.1-api-0:8.0.36-24.ep7.el7
  • tomcat8-webapps-0:8.0.36-24.ep7.el6
  • tomcat8-webapps-0:8.0.36-24.ep7.el7
  • jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7
  • jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6
  • jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7
  • tomcat6-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-admin-webapps-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-admin-webapps-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-docs-webapp-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-docs-webapp-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-el-2.1-api-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-el-2.1-api-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-javadoc-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-javadoc-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-jsp-2.1-api-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-jsp-2.1-api-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-lib-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-lib-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-log4j-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-log4j-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-maven-devel-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-maven-devel-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-servlet-2.5-api-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-servlet-2.5-api-0:6.0.41-17_patch_04.ep6.el7
  • tomcat6-webapps-0:6.0.41-17_patch_04.ep6.el6
  • tomcat6-webapps-0:6.0.41-17_patch_04.ep6.el7
  • tomcat7-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-admin-webapps-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-admin-webapps-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-docs-webapp-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-docs-webapp-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-el-2.2-api-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-el-2.2-api-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-javadoc-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-javadoc-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-jsp-2.2-api-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-jsp-2.2-api-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-lib-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-lib-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-log4j-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-log4j-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-maven-devel-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-maven-devel-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-servlet-3.0-api-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-servlet-3.0-api-0:7.0.54-25_patch_05.ep6.el7
  • tomcat7-webapps-0:7.0.54-25_patch_05.ep6.el6
  • tomcat7-webapps-0:7.0.54-25_patch_05.ep6.el7

References