NetSight
IP …
medium5.9

CVE-2018-0734

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack.

Impact

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p).

Affected products

VendorProductAffected versions
OpensslOpenssl
from 1.0.2 through 1.0.2p
from 1.1.0 through 1.1.0i
Version 1.1.1
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 18.10
DebianDebian Linux
Version 9.0
NodejsNode.Js
from 6.0.0 through 6.8.1
from 6.9.0 before 6.15.0
from 8.0.0 through 8.8.1
from 8.9.0 before 8.14.0
from 10.0.0 through 10.12.0
from 11.0.0 before 11.3.0
NetappCn1610 Firmware
All versions
NetappCloud Backup
All versions
NetappOncommand Unified Manager
All versions
NetappSantricity Smi-S Provider
All versions
NetappSnapcenter
All versions
NetappSteelstore
All versions
NetappStorage Automation Store
All versions
OracleApi Gateway
Version 11.1.2.4.0

Weakness classification

CWE-327

References