Bugzilla – Bug 938906
VUL-0: nrpe: The Logjam Attack / weakdh.org
Last modified: 2023-03-16 08:22:52 UTC
+++ This bug was initially created as a clone of Bug #931600 +++ nrpe uses hardcoded 512 bit dh parameters. src/nrpe.c /* ADDED 01/19/2004 */ /* use only TLSv1 protocol */ SSL_CTX_set_options(ctx,SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3); /* use anonymous DH ciphers */ SSL_CTX_set_cipher_list(ctx,"ADH"); dh=get_dh512(); SSL_CTX_set_tmp_dh(ctx,dh); DH_free(dh); use a DH parameter of at least 1024 if not 2048 bit.
Created attachment 641539 [details] dhparamselect.c extract of sample dh selection code from Apache2 2.4.10
bugbot adjusting priority
Lars, please submit for this. Thank you.
ping. Please submit
Leap 42.3 => 614056
SLE12-SP4 => (In reply to Lars Vogdt from comment #12) > Leap 42.3 => 614056 Oops, sorry! Was: 614057
This is an autogenerated message for OBS integration: This bug (938906) was mentioned in https://build.opensuse.org/request/show/614056 Factory / nrpe
^ done from my side, handling over to maintenance team.
SUSE-SU-2018:1768-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 938906 CVE References: CVE-2015-4000 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): nagios-nrpe-2.12-24.4.10.3.3 SUSE Linux Enterprise Debuginfo 11-SP4 (src): nagios-nrpe-2.12-24.4.10.3.3
SUSE-SU-2023:0586-1: An update that solves one vulnerability and has one fix can now be installed. Category: security (moderate) Bug References: 931600, 938906 CVE References: CVE-2015-4000 Sources used: SUSE OpenStack Cloud 9 (src): nrpe-2.15-6.3.1 SUSE OpenStack Cloud Crowbar 9 (src): nrpe-2.15-6.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4 (src): nrpe-2.15-6.3.1 SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): nrpe-2.15-6.3.1 SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (src): nrpe-2.15-6.3.1 SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (src): nrpe-2.15-6.3.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): nrpe-2.15-6.3.1 SUSE Linux Enterprise Server 12 SP5 (src): nrpe-2.15-6.3.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): nrpe-2.15-6.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Looks like the maintenance bot is not working as I expected. Closing here.