Source: openssl Version: 1.1.0f-3 Severity: important Tags: patch security upstream Control: clone -1 -2 Control: reassign -2 openssl1.0 1.0.2l-2 Control: retitle -2 openssl1.0: CVE-2018-0737: Cache timing vulnerability in RSA Key Generation Source
Hi, The following vulnerability was published for openssl. CVE-2018-0737[0]: | The OpenSSL RSA Key generation algorithm has been shown to be | vulnerable to a cache timing side channel attack. An attacker with | sufficient access to mount cache timing attacks during the RSA key | generation process could recover the private key. Fixed in OpenSSL | 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev | (Affected 1.0.2b-1.0.2o). If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2018-0737 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0737 [1] https://www.openssl.org/news/secadv/20180416.txt Please adjust the affected versions in the BTS as needed. Regards, Salvatore