Medium [CVE-2018-0734] Timing attack against DSA
This medium-severity Red Hat Linux advisory covers CVE-2018-0734 affecting JBoss Core Services on RHEL 6, JBoss Core Services on RHEL 7, Red Hat Ansible Tower 3.4 for RHEL 7.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key.
Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Red Hat severity: Low — CVSS 5.1 (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Weakness: CWE-385.
Affected Red Hat products: JBoss Core Services on RHEL 6; JBoss Core Services on RHEL 7; Red Hat Ansible Tower 3.4 for RHEL 7; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat JBoss Core Services; Red Hat Enterprise Linux 6; Red Hat JBoss Enterprise Application Platform 6; Red Hat JBoss Enterprise Web Server 2; Red Hat JBoss Web Server 3.
Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat JBoss Enterprise Web Server 2. Red Hat fixing advisory: RHSA-2019:3932, RHSA-2019:3933, RHBA-2020:0547, RHSA-2019:2304, RHSA-2019:3700, RHSA-2019:3935.
Affected products named by the advisory: Red Hat package: openssl098e; Red Hat package: ovmf; Red Hat package: compat-openssl10; Red Hat package: mingw-openssl.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
- 1.1.1
- 1.1.0-1
- 1.0.2-1
- jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6
- jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6
- jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6
- jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6
- jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6
- jbcs-httpd24-jansson-0:2.11-20.jbcs.el6
- jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6
- jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6
- jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6
- jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6
- jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6
- jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7
- jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7
- jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7
- jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7
- jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7
- jbcs-httpd24-jansson-0:2.11-20.jbcs.el7
- jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7
- jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7
- jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7
- jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7
- jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7
- ansible-tower-34/ansible-tower-memcached:1.4.15-28
- ansible-tower-35/ansible-tower-memcached:1.4.15-28
- ansible-tower-37/ansible-tower-memcached-rhel7:1.4.15-28
- openssl-1:1.0.2k-19.el7
- openssl-1:1.1.1c-2.el8
- openssl
- RHSA-2019:3932
- RHSA-2019:3933
- RHBA-2020:0547
- RHSA-2019:2304
- RHSA-2019:3700
- RHSA-2019:3935
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Mitigation
Upgrade to a fixed release: 1.1.1, 1.1.0-1, 1.0.2-1, jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6, jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6, jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.