Huawei EulerOS: Security Advisory for openssl110f (EulerOS-SA-2018-1306)

The remote host is missing an update for the Huawei EulerOS 'openssl110f' package(s) announced via the EulerOS-SA-2018-1306 advisory.

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack.(CVE-2017-0732) OpenSSL RSA key generation was found to be vulnerable to cache side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover parts of the private key.(CVE-2018-0737)

'openssl110f' package(s) on Huawei EulerOS V2.0SP2.

Checks if a vulnerable package version is present on the target host.

Please install the updated package(s).