Sign-up

ID

VAR-201811-0912


CVE

CVE-2018-5407


TITLE

OpenSSL Information disclosure vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-201811-279

DESCRIPTION

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'. OpenSSL is prone to a local information-disclosure vulnerability. Local attackers can exploit this issue to obtain sensitive information. This may aid in further attacks. OpenSSL is an open source general encryption library of the OpenSSL team that can implement the Secure Sockets Layer (SSLv2/v3) and Transport Layer Security (TLSv1) protocols. The product supports a variety of encryption algorithms, including symmetric ciphers, hash algorithms, secure hash algorithms, etc. This vulnerability stems from configuration errors in network systems or products during operation. OpenSSL Security Advisory [12 November 2018] ============================================ Microarchitecture timing vulnerability in ECC scalar multiplication (CVE-2018-5407) =================================================================================== Severity: Low OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been shown to be vulnerable to a microarchitecture timing side channel attack. An attacker with sufficient access to mount local timing attacks during ECDSA signature generation could recover the private key. This issue does not impact OpenSSL 1.1.1 and is already fixed in the latest version of OpenSSL 1.1.0 (1.1.0i). OpenSSL 1.0.2 is affected but due to the low severity of this issue we are not creating a new release at this time. The 1.0.2 mitigation for this issue can be found in commit b18162a7c. OpenSSL 1.1.0 users should upgrade to 1.1.0i. This issue was reported to OpenSSL on 26th October 2018 by Alejandro Cabrera Aldaya, Billy Brumley, Sohaib ul Hassan, Cesar Pereida Garcia and Nicola Tuveri. Note ==== OpenSSL 1.1.0 is currently only receiving security updates. Support for this version will end on 11th September 2019. Users of this version should upgrade to OpenSSL 1.1.1. References ========== URL for this Security Advisory: https://www.openssl.org/news/secadv/20181112.txt Note: the online version of the advisory may be updated with additional details over time. For details of OpenSSL severity classifications please see: https://www.openssl.org/policies/secpolicy.html . Solution: For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/ index.html 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-4348-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff November 30, 2018 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : openssl CVE ID : CVE-2018-0732 CVE-2018-0734 CVE-2018-0735 CVE-2018-0737 CVE-2018-5407 Several local side channel attacks and a denial of service via large Diffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets Layer toolkit. For the stable distribution (stretch), these problems have been fixed in version 1.1.0j-1~deb9u1. For the detailed security status of openssl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/openssl Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlwBuAcACgkQEMKTtsN8 TjZbBw/+MOB5+pZbCHHXyH3IeD+yj+tSPvmNc3SCwdEtUxGXr0ZX7TKHfaLs/8s6 Udto0K8a1FvjrcUQCfhnFpNcSAv9pxX13Fr6Pd560miIfAu9/5jAqiCufCoiz+xj 45LNJGlaxxaFjgBGCitZSJA0Fc4SM6v5XFyJfR3kChdQ/3kGQbbMNAp16Fy3ZsxJ VXwviomUxmmmdvjxyhifTIpuwr9OiJSQ+13etQjTDQ3pzSbLBPSOxmpV0vPIC7I2 Dwa4zuQXA/DF4G6l8T4rXCwCN4e4pwbTc8bbCjXeZK+iVAhnRD6wXlS3cc5IVAzx /qTa89LZU8B6ylcB6nodeAHLuZTC3Le8ndoxYz5S2/jHZMM/jCQNHYJemHWNbOqn q+e5W0D1fIVLiLoL/iHW5XhN6yJY2Ma7zjXMRBnkzJA9CTNIKgUjrSFz0Ud+wIM/ u8QhNPwZ0hPd5IfSgIyWqmuQ5XzFYqAQvwT1gUJiK7tIvuT0VsSyKVaSZVbi4yrM 9sxkZaP1UNLcTVCFw6A0KFwhb9z6kQtyH1MRkFPphmnb8jlHA3cTdPJkFUBi3VaT 7izThm5/mVLbAjZ8X7nkqnzWzmc885j0ml3slDd/MOVWB5CD3vFAcI8k3VZr3A61 P2gNSN6UbAbLMGsxgs3hYUHgazi7MdXJ/aNavjGSbYBNL780Iaw=3Qji -----END PGP SIGNATURE----- . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7 Advisory ID: RHSA-2019:3933-01 Product: Red Hat JBoss Core Services Advisory URL: https://access.redhat.com/errata/RHSA-2019:3933 Issue date: 2019-11-20 CVE Names: CVE-2018-0734 CVE-2018-0737 CVE-2018-5407 CVE-2018-17189 CVE-2018-17199 CVE-2019-0196 CVE-2019-0197 CVE-2019-0217 CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 CVE-2019-9517 ===================================================================== 1. Summary: An update is now available for JBoss Core Services on RHEL 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss Core Services on RHEL 7 Server - noarch, ppc64, x86_64 3. Description: This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es): * openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) * mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2: read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1568253 - CVE-2018-0737 openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys 1644364 - CVE-2018-0734 openssl: timing side channel attack in the DSA signature algorithm 1645695 - CVE-2018-5407 openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) 1668493 - CVE-2018-17199 httpd: mod_session_cookie does not respect expiry time 1668497 - CVE-2018-17189 httpd: mod_http2: DoS via slow, unneeded request bodies 1695020 - CVE-2019-0217 httpd: mod_auth_digest: access control bypass due to race condition 1695030 - CVE-2019-0196 httpd: mod_http2: read-after-free on a string compare 1695042 - CVE-2019-0197 httpd: mod_http2: possible crash on late upgrade 1735741 - CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption 1741860 - CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service 1741864 - CVE-2019-9516 HTTP/2: 0-length headers lead to denial of service 1741868 - CVE-2019-9517 HTTP/2: request for large response leads to denial of service 6. Package List: Red Hat JBoss Core Services on RHEL 7 Server: Source: jbcs-httpd24-apr-1.6.3-63.jbcs.el7.src.rpm jbcs-httpd24-apr-util-1.6.1-48.jbcs.el7.src.rpm jbcs-httpd24-brotli-1.0.6-7.jbcs.el7.src.rpm jbcs-httpd24-curl-7.64.1-14.jbcs.el7.src.rpm jbcs-httpd24-httpd-2.4.37-33.jbcs.el7.src.rpm jbcs-httpd24-jansson-2.11-20.jbcs.el7.src.rpm jbcs-httpd24-mod_cluster-native-1.3.12-9.Final_redhat_2.jbcs.el7.src.rpm jbcs-httpd24-mod_jk-1.2.46-22.redhat_1.jbcs.el7.src.rpm jbcs-httpd24-mod_security-2.9.2-16.GA.jbcs.el7.src.rpm jbcs-httpd24-nghttp2-1.39.2-4.jbcs.el7.src.rpm jbcs-httpd24-openssl-1.1.1-25.jbcs.el7.src.rpm noarch: jbcs-httpd24-httpd-manual-2.4.37-33.jbcs.el7.noarch.rpm ppc64: jbcs-httpd24-brotli-1.0.6-7.jbcs.el7.ppc64.rpm jbcs-httpd24-brotli-debuginfo-1.0.6-7.jbcs.el7.ppc64.rpm jbcs-httpd24-brotli-devel-1.0.6-7.jbcs.el7.ppc64.rpm jbcs-httpd24-curl-7.64.1-14.jbcs.el7.ppc64.rpm jbcs-httpd24-curl-debuginfo-7.64.1-14.jbcs.el7.ppc64.rpm jbcs-httpd24-httpd-debuginfo-2.4.37-33.jbcs.el7.ppc64.rpm jbcs-httpd24-jansson-2.11-20.jbcs.el7.ppc64.rpm jbcs-httpd24-jansson-debuginfo-2.11-20.jbcs.el7.ppc64.rpm jbcs-httpd24-jansson-devel-2.11-20.jbcs.el7.ppc64.rpm jbcs-httpd24-libcurl-7.64.1-14.jbcs.el7.ppc64.rpm jbcs-httpd24-libcurl-devel-7.64.1-14.jbcs.el7.ppc64.rpm jbcs-httpd24-mod_md-2.4.37-33.jbcs.el7.ppc64.rpm x86_64: jbcs-httpd24-apr-1.6.3-63.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-debuginfo-1.6.3-63.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-debuginfo-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-devel-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-ldap-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-mysql-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-nss-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-odbc-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-openssl-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-pgsql-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-apr-util-sqlite-1.6.1-48.jbcs.el7.x86_64.rpm jbcs-httpd24-brotli-1.0.6-7.jbcs.el7.x86_64.rpm jbcs-httpd24-brotli-debuginfo-1.0.6-7.jbcs.el7.x86_64.rpm jbcs-httpd24-brotli-devel-1.0.6-7.jbcs.el7.x86_64.rpm jbcs-httpd24-curl-7.64.1-14.jbcs.el7.x86_64.rpm jbcs-httpd24-curl-debuginfo-7.64.1-14.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-debuginfo-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-devel-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-selinux-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-httpd-tools-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-jansson-2.11-20.jbcs.el7.x86_64.rpm jbcs-httpd24-jansson-debuginfo-2.11-20.jbcs.el7.x86_64.rpm jbcs-httpd24-jansson-devel-2.11-20.jbcs.el7.x86_64.rpm jbcs-httpd24-libcurl-7.64.1-14.jbcs.el7.x86_64.rpm jbcs-httpd24-libcurl-devel-7.64.1-14.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_cluster-native-1.3.12-9.Final_redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_cluster-native-debuginfo-1.3.12-9.Final_redhat_2.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-ap24-1.2.46-22.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-debuginfo-1.2.46-22.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_jk-manual-1.2.46-22.redhat_1.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_ldap-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_md-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_proxy_html-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_security-2.9.2-16.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_security-debuginfo-2.9.2-16.GA.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_session-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-mod_ssl-2.4.37-33.jbcs.el7.x86_64.rpm jbcs-httpd24-nghttp2-1.39.2-4.jbcs.el7.x86_64.rpm jbcs-httpd24-nghttp2-debuginfo-1.39.2-4.jbcs.el7.x86_64.rpm jbcs-httpd24-nghttp2-devel-1.39.2-4.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-1.1.1-25.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-debuginfo-1.1.1-25.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-devel-1.1.1-25.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-libs-1.1.1-25.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-perl-1.1.1-25.jbcs.el7.x86_64.rpm jbcs-httpd24-openssl-static-1.1.1-25.jbcs.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-0734 https://access.redhat.com/security/cve/CVE-2018-0737 https://access.redhat.com/security/cve/CVE-2018-5407 https://access.redhat.com/security/cve/CVE-2018-17189 https://access.redhat.com/security/cve/CVE-2018-17199 https://access.redhat.com/security/cve/CVE-2019-0196 https://access.redhat.com/security/cve/CVE-2019-0197 https://access.redhat.com/security/cve/CVE-2019-0217 https://access.redhat.com/security/cve/CVE-2019-9511 https://access.redhat.com/security/cve/CVE-2019-9513 https://access.redhat.com/security/cve/CVE-2019-9516 https://access.redhat.com/security/cve/CVE-2019-9517 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXdVmUNzjgjWX9erEAQgHaA/5ATJ1vNONW5SjAljtzRcgd0M7yegmqkML /+Fau+KCMjV6qEz5Hd79mubu+uf405EXfuJdi0Da5vbBVEK9PY5H+46Ea5BozqJE mgPIulbir54fQkWV/8eltCF7GRcs1k+DRa8NLGyXZxAcgKXxy4vAx00tjPEwPAZw CLPHLujYehq5Wty83gvnST8Set3n2f0eREbLpFMMIUZDErGlh6PZs1I1Id1BaBDF SAAiZeWmwF3jOTknmkZc8m+dnFrn80hF5O5QwadlNgn2FmheT365hW+443z5RTlM bL+pboWM9mmd9NAHse0lwW2IARA5Vr593qbbMwOGXrt9PEhivpRcMbbKb7JMEJQY 6HM+Eo/5vPzA4iR+c5OzdsF3fSYdigR7duUNU40QZbP+++RyaCYSxLM9XSfDe9v/ YQi7TgZ/iv9vilMtNvHsrLzgpj7ltLl3Qk6HB+2zBLJOivf/Quji1efEFE59bfkS TJ4pCLc7JA1dN5Xg4+xyn8d60JVG/w+ZloPLYegXL4yU8mb0Fz/3AFS99kEsok6U hq5p3/qWJmM0MMFmwPVAM6nIYPJai6xKmGzN2d42LG7bTFhAEGFQuvrnSWm49b3Q 4TaV/VN89NjpxXxB4mn0eK4lCtndEYGTXnIZTRv1ju60Zsoz+YcQf/Xy/236CvnK TbHYaKmVCfE= =6pM8 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

Trust: 1.98

sources: NVD: CVE-2018-5407 // BID: 105897 // VULHUB: VHN-135438 // VULMON: CVE-2018-5407 // PACKETSTORM: 169678 // PACKETSTORM: 152240 // PACKETSTORM: 155414 // PACKETSTORM: 150860 // PACKETSTORM: 150561 // PACKETSTORM: 155416 // PACKETSTORM: 152241

AFFECTED PRODUCTS

vendor:oraclemodel:mysql enterprise backupscope:lteversion:3.12.3

Trust: 1.0

vendor:redhatmodel:enterprise linux serverscope:eqversion:7.6

Trust: 1.0

vendor:oraclemodel:mysql enterprise backupscope:lteversion:4.1.2

Trust: 1.0

vendor:nodejsmodel:node.jsscope:ltversion:6.14.4

Trust: 1.0

vendor:redhatmodel:enterprise linux server tusscope:eqversion:7.6

Trust: 1.0

vendor:nodejsmodel:node.jsscope:gteversion:8.0.0

Trust: 1.0

vendor:redhatmodel:enterprise linux serverscope:eqversion:7.0

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:eqversion:15.2

Trust: 1.0

vendor:nodejsmodel:node.jsscope:gteversion:10.0.0

Trust: 1.0

vendor:oraclemodel:enterprise manager base platformscope:eqversion:13.2.0.0.0

Trust: 1.0

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.56

Trust: 1.0

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.57

Trust: 1.0

vendor:oraclemodel:vm virtualboxscope:ltversion:6.0.0

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:eqversion:16.2

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:eqversion:18.8

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:14.04

Trust: 1.0

vendor:oraclemodel:application serverscope:eqversion:1.0.1

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:gteversion:17.7

Trust: 1.0

vendor:redhatmodel:enterprise linux desktopscope:eqversion:7.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:8.0

Trust: 1.0

vendor:oraclemodel:application serverscope:eqversion:0.9.8

Trust: 1.0

vendor:tenablemodel:nessusscope:ltversion:8.1.1

Trust: 1.0

vendor:oraclemodel:peoplesoft enterprise peopletoolsscope:eqversion:8.55

Trust: 1.0

vendor:opensslmodel:opensslscope:ltversion:1.0.2q

Trust: 1.0

vendor:opensslmodel:opensslscope:gteversion:1.0.2

Trust: 1.0

vendor:redhatmodel:enterprise linux workstationscope:eqversion:7.0

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:18.04

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:16.04

Trust: 1.0

vendor:oraclemodel:application serverscope:eqversion:1.0.0

Trust: 1.0

vendor:redhatmodel:enterprise linux server ausscope:eqversion:7.6

Trust: 1.0

vendor:nodejsmodel:node.jsscope:ltversion:8.11.4

Trust: 1.0

vendor:opensslmodel:opensslscope:ltversion:1.1.0i

Trust: 1.0

vendor:oraclemodel:api gatewayscope:eqversion:11.1.2.4.0

Trust: 1.0

vendor:oraclemodel:enterprise manager ops centerscope:eqversion:12.3.3

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:18.10

Trust: 1.0

vendor:oraclemodel:tuxedoscope:eqversion:12.1.1.0.0

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:eqversion:15.1

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:eqversion:16.1

Trust: 1.0

vendor:opensslmodel:opensslscope:gteversion:1.1.0

Trust: 1.0

vendor:oraclemodel:enterprise manager base platformscope:eqversion:12.1.0.5.0

Trust: 1.0

vendor:redhatmodel:enterprise linux server eusscope:eqversion:7.6

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:lteversion:17.12

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:oraclemodel:enterprise manager base platformscope:eqversion:13.3.0.0.0

Trust: 1.0

vendor:nodejsmodel:node.jsscope:ltversion:10.9.0

Trust: 1.0

vendor:oraclemodel:primavera p6 enterprise project portfolio managementscope:eqversion:8.4

Trust: 1.0

vendor:oraclemodel:mysql enterprise backupscope:gteversion:3.12.4

Trust: 1.0

vendor:opensslmodel:opensslscope:eqversion:1.1.0h

Trust: 0.6

vendor:tenablemodel:nessusscope:eqversion:8.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:8.0

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:7.2.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:7.2.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:7.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:7.1.3

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:7.1.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:7.1.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:7.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.9.3

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.9

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.8

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.7

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.6.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.6.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.6

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.5.6

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.5.5

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.5.4

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.5.3

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.5.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.5.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.5

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.4.3

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.4.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.4.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.4

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.3.7

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.3.6

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.3.5

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.3.4

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.3.3

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.3.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.3.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.3

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.2.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.1.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.1.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.0.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.0.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.0

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:5.2.7

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:5.2.4

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:5.2.3

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:1.0.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:7.0

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.9.2

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:6.9.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:4.4.1

Trust: 0.3

vendor:tenablemodel:nessusscope:eqversion:3.0.3

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:7

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:6

Trust: 0.3

vendor:redhatmodel:enterprise linuxscope:eqversion:5

Trust: 0.3

vendor:oraclemodel:solarisscope:eqversion:11.4

Trust: 0.3

vendor:oraclemodel:solarisscope:eqversion:11.3

Trust: 0.3

vendor:oraclemodel:solarisscope:eqversion:10

Trust: 0.3

vendor:opensslmodel:project opensslscope:eqversion:1.0.2

Trust: 0.3

vendor:opensslmodel:project openssl 1.1.0hscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.1.0gscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.1.0fscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.1.0escope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.1.0dscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.1.0cscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.1.0bscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.1.0ascope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2pscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2oscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2nscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2mscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2l-gitscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2lscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2kscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2jscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2iscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2hscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2gscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2fscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2escope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2dscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2cscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2bscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2ascope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2-1.0.2oscope: - version: -

Trust: 0.3

vendor:opensslmodel:project openssl beta1scope:eqversion:1.0.2

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.3

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.14

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.4.0

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.3.50

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.3.4

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.3.3

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.3.2

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.3.0

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.2.6

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.2.5

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.2.4

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.2.0

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.1.9

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.1.8

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.1.3

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.1.1

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.1.0

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.0.13

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.0.12

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.0.11

Trust: 0.3

vendor:ibmmodel:viosscope:eqversion:2.2.0.10

Trust: 0.3

vendor:ibmmodel:aixscope:eqversion:7.2

Trust: 0.3

vendor:ibmmodel:aixscope:eqversion:7.1

Trust: 0.3

vendor:ibmmodel:aixscope:eqversion:6.1

Trust: 0.3

vendor:ibmmodel:aixscope:eqversion:5.3

Trust: 0.3

vendor:tenablemodel:nessusscope:neversion:8.1.1

Trust: 0.3

vendor:opensslmodel:project opensslscope:neversion:1.1.1

Trust: 0.3

vendor:opensslmodel:project openssl 1.1.0iscope:neversion: -

Trust: 0.3

vendor:opensslmodel:project openssl 1.0.2qscope:neversion: -

Trust: 0.3

sources: BID: 105897 // CNNVD: CNNVD-201811-279 // NVD: CVE-2018-5407

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-5407
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-201811-279
value: MEDIUM

Trust: 0.6

VULHUB: VHN-135438
value: LOW

Trust: 0.1

VULMON: CVE-2018-5407
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2018-5407
severity: LOW
baseScore: 1.9
vectorString: AV:L/AC:M/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-135438
severity: LOW
baseScore: 1.9
vectorString: AV:L/AC:M/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-5407
baseSeverity: MEDIUM
baseScore: 4.7
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.0
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-135438 // VULMON: CVE-2018-5407 // CNNVD: CNNVD-201811-279 // NVD: CVE-2018-5407

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.1

problemtype:CWE-203

Trust: 1.1

sources: VULHUB: VHN-135438 // NVD: CVE-2018-5407

THREAT TYPE

local

Trust: 1.2

sources: BID: 105897 // PACKETSTORM: 169678 // PACKETSTORM: 150860 // PACKETSTORM: 150561 // CNNVD: CNNVD-201811-279

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201811-279

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-135438 // 
            
            
            
            VULMON: CVE-2018-5407

PATCH
title:Red Hat: Moderate: openssl security and bug fix updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20190483 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat Ansible Tower 3.4.3url:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20190651 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat JBoss Web Server 5.2 security releaseurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193931 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat JBoss Web Server 5.2 security releaseurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193929 - Security Advisory
Trust: 0.1
title:Red Hat: Moderate: Red Hat Ansible Tower 3.3.5url:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20190652 - Security Advisory
Trust: 0.1
title:Ubuntu Security Notice: openssl, openssl1.0 vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3840-1
Trust: 0.1
title:Red Hat: CVE-2018-5407url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2018-5407
Trust: 0.1
title:HP: HPSBHF03597 rev. 3 - PortSmash Side-Channel Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=hp_bulletin&qid=HPSBHF03597
Trust: 0.1
title:Arch Linux Issues: url:https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues&qid=CVE-2018-5407
Trust: 0.1
title:Arch Linux Advisories: [ASA-201812-7] lib32-openssl-1.0: private key recoveryurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201812-7
Trust: 0.1
title:Red Hat: Moderate: ovmf security and enhancement updateurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20192125 - Security Advisory
Trust: 0.1
title:HP: SUPPORT COMMUNICATION- SECURITY BULLETIN
HPSBHF03597 rev. 3 - PortSmash Side-Channel Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=hp_bulletin&qid=ffa91dec4581eb47b3539880d466865f
Trust: 0.1
title:Amazon Linux AMI: ALAS-2019-1188url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami&qid=ALAS-2019-1188
Trust: 0.1
title:Arch Linux Advisories: [ASA-201812-8] openssl-1.0: private key recoveryurl:https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories&qid=ASA-201812-8
Trust: 0.1
title:Debian Security Advisories: DSA-4355-1 openssl1.0 -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=7cc6b04edacd67d6e5bf27bd36f54217
Trust: 0.1
title:Amazon Linux 2: ALAS2-2019-1188url:https://vulmon.com/vendoradvisory?qidtp=amazon_linux2&qid=ALAS2-2019-1188
Trust: 0.1
title:Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Releaseurl:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193935 - Security Advisory
Trust: 0.1
title:IBM: IBM Security Bulletin: IBM QRadar Network Security is affected by a an openssl vulnerability (CVE-2018-5407)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=002162619f80b70121c9a8d365823283
Trust: 0.1
title:IBM: IBM Security Bulletin: OpenSSL as used in IBM QRadar SIEM is vulnerable to a information disclosure (CVE-2018-5407)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=8aafdc7a03aa0793602eaa5ae3724cec
Trust: 0.1
title:Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6url:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193932 - Security Advisory
Trust: 0.1
title:Red Hat: Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7url:https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories&qid=RHSA-20193933 - Security Advisory
Trust: 0.1
title:Debian Security Advisories: DSA-4348-1 openssl -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=322bd50b7b929759e38c99b73122a852
Trust: 0.1
title:IBM: IBM Security Bulletin: Vulnerability in OpenSSL affects IBM Integrated Analytics Systemurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=78c4a4229b60aec60d80d95cb29a4147
Trust: 0.1
title:IBM: IBM Security Bulletin: A vulnerability in OpenSSL affects PowerKVMurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=e1dbc019531cd5742827de595730d1b0
Trust: 0.1
title:IBM: IBM Security Bulletin: IBM has released Unified Extensible Firmware Interface (UEFI) fixes in response to OpenSSL vulnerability CVE-2018-5407url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=e2e9722c1fb1c14c9f54120082381491
Trust: 0.1
title:IBM: IBM Security Bulletin: A security vulnerability has been identified in OpenSSL, which is shipped with IBM Tivoli Network Manager IP Edition (CVE-2018-5407)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=49fff94fe759cd40f1f516a339f15743
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple Security Vulnerabilities in OpenSSL Affect IBM Sterling B2B Integrator (CVE-2018-0734, CVE-2018-5407)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=e4ca493bfda92c5355c98328872a84e5
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Rational ClearQuest (CVE-2018-0734, CVE-2018-5407)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=c36f1dd66164e22918d817553be91620
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Sterling Connect:Express for UNIX (CVE-2018-0734 and CVE-2018-5407)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=fda6d001f041b9b0a29d906059d798b4
Trust: 0.1
title:IBM: IBM Security Bulletin: IBM DataPower Gateway is affected by vulnerabilities in OpenSSLurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=c7313d7a6ba5364a603c214269588feb
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Rational ClearCase (CVE-2018-0734, CVE-2018-5407)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=ddeebd7237369bd2318e4087834121a5
Trust: 0.1
title:IBM: IBM Security Bulletin: Security vulnerabilities identified in OpenSSL affect Rational Build Forge (CVE-2018-0734, CVE-2018-5407 and CVE-2019-1559)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=e59d7f075c856823d6f7370dea35e662
Trust: 0.1
title:Tenable Security Advisories: [R1] Nessus 8.1.1 Fixes Multiple Third-party Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories&qid=TNS-2018-16
Trust: 0.1
title:IBM: IBM Security Bulletin: IBM Event Streams is affected by OpenSSL vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=efdce9b94f89918f3f2b2dfc69780ccd
Trust: 0.1
title:IBM: IBM Security Bulletin: IBM InfoSphere Master Data Management Standard and Advanced Editions are affected by vulnerabilities in OpenSSL (CVE-2018-0735, CVE-2018-0734, CVE-2018-5407)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=c829d56f5888779e791387897875c4b4
Trust: 0.1
title:Tenable Security Advisories: [R1] Nessus 7.1.4 Fixes Multiple Third-party Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories&qid=TNS-2018-17
Trust: 0.1
title:IBM: IBM Security Bulletin: BigFix Platform 9.2.x affected by multiple vulnerabilities (CVE-2017-1231, CVE-2018-5407, CVE-2012-5883, CVE-2012-6708, CVE-2015-9251)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=3101664cb57ad9d937108c187df59ecf
Trust: 0.1
title:IBM: IBM Security Bulletin: BigFix Platform 9.5.x affected by multiple vulnerabilities (CVE-2019-4013, CVE-2018-5407, CVE-2012-5883, CVE-2012-6708, CVE-2015-9251)url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=7dde8d528837d3c0eae28428fd6e703d
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private – Node.jsurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=2e571e7bc5566212c3e69e37ecfa5ad4
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Softwareurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=2bd72b857f21f300d83d07a791be44cf
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Cloud App Management V2018url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=dce787e9d669a768893a91801bf5eea4
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple vulnerabilities affect IBM® SDK for Node.js™ in IBM Cloudurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=26f585287da19915b94b6cae2d1b864f
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple Security Vulnerabilities have been addressed in IBM Security Access Manager Applianceurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=800337bc69aa7ad92ac88a2adcc7d426
Trust: 0.1
title:IBM: IBM Security Bulletin: Multiple Security Vulnerabilities affect IBM® Cloud Private – fluentdurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=60de0933c28b353f38df30120aa2a908
Trust: 0.1
title:Oracle: Oracle Critical Patch Update Advisory - January 2019url:https://vulmon.com/vendoradvisory?qidtp=oracle_advisories&qid=f655264a6935505d167bbf45f409a57b
Trust: 0.1
title:IBM: IBM Security Bulletin: Vyatta 5600 vRouter Software Patches – Releases 1801-w and 1801-yurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=bf3f2299a8658b7cd3984c40e7060666
Trust: 0.1
title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - January 2019url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=aea3fcafd82c179d3a5dfa015e920864
Trust: 0.1
title:IBM: IBM Security Bulletin: Vyatta 5600 vRouter Software Patches – Release 1801-vurl:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=413b5f9466c1ebf3ab090a45e189b43e
Trust: 0.1
title:IBM: IBM Security Bulletin: IBM API Connect has addressed multiple vulnerabilities in Developer Portal’s dependencies – Cumulative list from June 28, 2018 to December 13, 2018url:https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog&qid=43da2cd72c1e378d8d94ecec029fcc61
Trust: 0.1
title:portsmashurl:https://github.com/bbbrumley/portsmash 
Trust: 0.1
title:vygerurl:https://github.com/mrodden/vyger 
Trust: 0.1
title:Firmware-Securityurl:https://github.com/virusbeeE/Firmware-Security 
Trust: 0.1
title:Hardware-and-Firmware-Security-Guidanceurl:https://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance 
Trust: 0.1
title:hardware-attacks-state-of-the-arturl:https://github.com/codexlynx/hardware-attacks-state-of-the-art 
Trust: 0.1
title:Threatposturl:https://threatpost.com/portsmash-side-channel-attack-siphons-data-from-intel-other-cpus/138777/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2018-5407

EXTERNAL IDS
db:NVDid:CVE-2018-5407
Trust: 2.8
db:TENABLEid:TNS-2018-16
Trust: 2.1
db:BIDid:105897
Trust: 2.1
db:TENABLEid:TNS-2018-17
Trust: 1.8
db:EXPLOIT-DBid:45785
Trust: 1.8
db:PACKETSTORMid:152084
Trust: 0.7
db:CNNVDid:CNNVD-201811-279
Trust: 0.7
db:PACKETSTORMid:155414
Trust: 0.7
db:AUSCERTid:ESB-2019.0514
Trust: 0.6
db:AUSCERTid:ESB-2019.4293
Trust: 0.6
db:AUSCERTid:ESB-2019.0644.2
Trust: 0.6
db:AUSCERTid:ESB-2019.4405
Trust: 0.6
db:AUSCERTid:ESB-2022.0696
Trust: 0.6
db:AUSCERTid:ESB-2019.0811
Trust: 0.6
db:AUSCERTid:ESB-2019.0481
Trust: 0.6
db:AUSCERTid:ESB-2020.0529
Trust: 0.6
db:AUSCERTid:ESB-2019.3390.4
Trust: 0.6
db:PACKETSTORMid:152241
Trust: 0.2
db:PACKETSTORMid:152240
Trust: 0.2
db:PACKETSTORMid:150138
Trust: 0.1
db:PACKETSTORMid:155413
Trust: 0.1
db:PACKETSTORMid:152071
Trust: 0.1
db:PACKETSTORMid:155415
Trust: 0.1
db:VULHUBid:VHN-135438
Trust: 0.1
db:VULMONid:CVE-2018-5407
Trust: 0.1
db:PACKETSTORMid:169678
Trust: 0.1
db:PACKETSTORMid:150860
Trust: 0.1
db:PACKETSTORMid:150561
Trust: 0.1
db:PACKETSTORMid:155416
Trust: 0.1
sources:
            
            
            VULHUB: VHN-135438 // 
            
            
            
            VULMON: CVE-2018-5407 // 
            
            
            
            BID: 105897 // 
            
            
            
            PACKETSTORM: 169678 // 
            
            
            
            PACKETSTORM: 152240 // 
            
            
            
            PACKETSTORM: 155414 // 
            
            
            
            PACKETSTORM: 150860 // 
            
            
            
            PACKETSTORM: 150561 // 
            
            
            
            PACKETSTORM: 155416 // 
            
            
            
            PACKETSTORM: 152241 // 
            
            
            
            CNNVD: CNNVD-201811-279 // 
            
            
            
            NVD: CVE-2018-5407

REFERENCES
url:http://www.securityfocus.com/bid/105897
Trust: 2.5
url:https://access.redhat.com/errata/rhsa-2019:0483
Trust: 2.4
url:https://access.redhat.com/errata/rhsa-2019:3929
Trust: 2.4
url:https://access.redhat.com/errata/rhsa-2019:3931
Trust: 2.4
url:https://github.com/bbbrumley/portsmash
Trust: 2.2
url:https://www.tenable.com/security/tns-2018-16
Trust: 2.1
url:https://www.exploit-db.com/exploits/45785/
Trust: 1.9
url:https://access.redhat.com/errata/rhsa-2019:0651
Trust: 1.9
url:https://access.redhat.com/errata/rhsa-2019:0652
Trust: 1.9
url:https://access.redhat.com/errata/rhsa-2019:3933
Trust: 1.9
url:https://access.redhat.com/errata/rhsa-2019:3935
Trust: 1.9
url:https://usn.ubuntu.com/3840-1/
Trust: 1.9
url:https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/
Trust: 1.8
url:https://security.netapp.com/advisory/ntap-20181126-0001/
Trust: 1.8
url:https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Trust: 1.8
url:https://www.tenable.com/security/tns-2018-17
Trust: 1.8
url:https://www.debian.org/security/2018/dsa-4348
Trust: 1.8
url:https://www.debian.org/security/2018/dsa-4355
Trust: 1.8
url:https://security.gentoo.org/glsa/201903-10
Trust: 1.8
url:https://eprint.iacr.org/2018/1060.pdf
Trust: 1.8
url:https://www.oracle.com/security-alerts/cpuapr2020.html
Trust: 1.8
url:https://www.oracle.com/security-alerts/cpujan2020.html
Trust: 1.8
url:https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Trust: 1.8
url:https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Trust: 1.8
url:https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html
Trust: 1.8
url:https://access.redhat.com/errata/rhsa-2019:2125
Trust: 1.8
url:https://access.redhat.com/errata/rhsa-2019:3932
Trust: 1.8
url:https://support.f5.com/csp/article/k49711130?utm_source=f5support&amp%3butm_medium=rss
Trust: 1.1
url:https://access.redhat.com/security/cve/cve-2018-5407
Trust: 0.7
url:https://nvd.nist.gov/vuln/detail/cve-2018-5407
Trust: 0.7
url:https://support.f5.com/csp/article/k49711130?utm_source=f5support&utm_medium=rss
Trust: 0.6
url:https://support.symantec.com/us/en/article.symsa1490.html
Trust: 0.6
url:https://www.ibm.com/support/pages/node/1096270
Trust: 0.6
url:https://www.ibm.com/support/pages/node/1106139
Trust: 0.6
url:https://www.ibm.com/support/pages/node/1106487
Trust: 0.6
url:https://www.ibm.com/support/pages/node/1106553
Trust: 0.6
url:http://www.ibm.com/support/docview.wss
Trust: 0.6
url:https://www.auscert.org.au/bulletins/75658
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2022.0696
Trust: 0.6
url:https://www.auscert.org.au/bulletins/76338
Trust: 0.6
url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-openssl-affect-ibm-tivoli-netcool-system-service-monitors-application-service-monitors-cve-2018-5407cve-2020-1967cve-2018-0734cve-2019-1563cve-2019/
Trust: 0.6
url:https://www.ibm.com/support/pages/node/1106493
Trust: 0.6
url:https://packetstormsecurity.com/files/155414/red-hat-security-advisory-2019-3935-01.html
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.4405/
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.0529/
Trust: 0.6
url:https://packetstormsecurity.com/files/152084/gentoo-linux-security-advisory-201903-10.html
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.4293/
Trust: 0.6
url:https://www.ibm.com/support/docview.wss?uid=ibm10869830
Trust: 0.6
url:https://www.auscert.org.au/bulletins/77062
Trust: 0.6
url:https://www.ibm.com/support/pages/node/1143442
Trust: 0.6
url:https://www.ibm.com/support/pages/node/1118487
Trust: 0.6
url:https://www-01.ibm.com/support/docview.wss?uid=ibm10870936
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.3390.4/
Trust: 0.6
url:https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-openssl-affect-ibm-spectrum-protect-plus-cve-2018-0735-cve-2018-0734-cve-2018-5407/
Trust: 0.6
url:https://www-01.ibm.com/support/docview.wss?uid=ibm10873310
Trust: 0.6
url:https://www.auscert.org.au/bulletins/75802
Trust: 0.6
url:https://www.openssl.org/news/secadv/20181112.txt
Trust: 0.4
url:https://www.redhat.com/mailman/listinfo/rhsa-announce
Trust: 0.4
url:https://access.redhat.com/security/team/contact/
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2018-0737
Trust: 0.4
url:https://nvd.nist.gov/vuln/detail/cve-2018-0734
Trust: 0.4
url:https://www.openssl.org/news/cl102.txt
Trust: 0.3
url:http://openssl.org/
Trust: 0.3
url:https://bugzilla.redhat.com/show_bug.cgi?id=1645695
Trust: 0.3
url:https://www.openssl.org/news/openssl-1.0.2-notes.html
Trust: 0.3
url:https://www.oracle.com/technetwork/topics/security/bulletinjan2019-5251593.html
Trust: 0.3
url:http://aix.software.ibm.com/aix/efixes/security/openssl_advisory29.asc
Trust: 0.3
url:https://docs.ansible.com/ansible-tower/latest/html/release-notes/index.html
Trust: 0.2
url:https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/
Trust: 0.2
url:https://access.redhat.com/security/updates/classification/#moderate
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-9513
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2019-9511
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-9517
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-0197
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2018-17199
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-9511
Trust: 0.2
url:https://access.redhat.com/security/updates/classification/#important
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2018-17189
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2019-9517
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2018-0737
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2018-17199
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2019-9516
Trust: 0.2
url:https://access.redhat.com/articles/11258
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2019-9513
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2019-0217
Trust: 0.2
url:https://bugzilla.redhat.com/):
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-0217
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2019-0197
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2018-17189
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-9516
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2019-0196
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-0196
Trust: 0.2
url:https://access.redhat.com/security/cve/cve-2018-0734
Trust: 0.2
url:https://www.debian.org/security/faq
Trust: 0.2
url:https://www.debian.org/security/
Trust: 0.2
url:https://nvd.nist.gov/vuln/detail/cve-2018-0732
Trust: 0.2
url:https://support.f5.com/csp/article/k49711130?utm_source=f5support&amp;amp;utm_medium=rss
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/203.html
Trust: 0.1
url:https://threatpost.com/portsmash-side-channel-attack-siphons-data-from-intel-other-cpus/138777/
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://tools.cisco.com/security/center/viewalert.x?alertid=59118
Trust: 0.1
url:https://www.openssl.org/policies/secpolicy.html
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2019-3838
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2019-3838
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2019-3835
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2019-3835
Trust: 0.1
url:https://security-tracker.debian.org/tracker/openssl1.0
Trust: 0.1
url:https://security-tracker.debian.org/tracker/openssl
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-0735
Trust: 0.1
url:https://access.redhat.com/security/team/key/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-135438 // 
            
            
            
            VULMON: CVE-2018-5407 // 
            
            
            
            BID: 105897 // 
            
            
            
            PACKETSTORM: 169678 // 
            
            
            
            PACKETSTORM: 152240 // 
            
            
            
            PACKETSTORM: 155414 // 
            
            
            
            PACKETSTORM: 150860 // 
            
            
            
            PACKETSTORM: 150561 // 
            
            
            
            PACKETSTORM: 155416 // 
            
            
            
            PACKETSTORM: 152241 // 
            
            
            
            CNNVD: CNNVD-201811-279 // 
            
            
            
            NVD: CVE-2018-5407

CREDITS
Red Hat,Gentoo
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201811-279

SOURCES
db:VULHUBid:VHN-135438
db:VULMONid:CVE-2018-5407
db:BIDid:105897
db:PACKETSTORMid:169678
db:PACKETSTORMid:152240
db:PACKETSTORMid:155414
db:PACKETSTORMid:150860
db:PACKETSTORMid:150561
db:PACKETSTORMid:155416
db:PACKETSTORMid:152241
db:CNNVDid:CNNVD-201811-279
db:NVDid:CVE-2018-5407

LAST UPDATE DATE
2025-04-28T21:33:21.948000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-135438date:2020-09-18T00:00:00
db:VULMONid:CVE-2018-5407date:2023-11-07T00:00:00
db:BIDid:105897date:2019-01-17T10:00:00
db:CNNVDid:CNNVD-201811-279date:2022-03-10T00:00:00
db:NVDid:CVE-2018-5407date:2024-11-21T04:08:45.530

SOURCES RELEASE DATE
db:VULHUBid:VHN-135438date:2018-11-15T00:00:00
db:VULMONid:CVE-2018-5407date:2018-11-15T00:00:00
db:BIDid:105897date:2018-10-30T00:00:00
db:PACKETSTORMid:169678date:2018-11-12T12:12:12
db:PACKETSTORMid:152240date:2019-03-27T00:33:09
db:PACKETSTORMid:155414date:2019-11-20T23:02:22
db:PACKETSTORMid:150860date:2018-12-20T15:05:22
db:PACKETSTORMid:150561date:2018-12-03T21:06:37
db:PACKETSTORMid:155416date:2019-11-20T20:55:55
db:PACKETSTORMid:152241date:2019-03-27T00:35:38
db:CNNVDid:CNNVD-201811-279date:2018-11-12T00:00:00
db:NVDid:CVE-2018-5407date:2018-11-15T21:29:00.233