Chapter 5. Security Fixes

This update includes fixes for the following security related issues:

Expand

ID	Impact	Summary
CVE-2018-0495	Moderate	ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries
CVE-2018-0732	Moderate	openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang
CVE-2018-0734	Low	openssl: timing side channel attack in the DSA signature algorithm
CVE-2018-0737	Low	openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys
CVE-2019-0221	Low	tomcat: XSS in SSI printenv
CVE-2019-1559	Moderate	openssl: 0-byte record padding oracle
CVE-2019-12418	Moderate	tomcat: local privilege escalation
CVE-2019-17563	Low	tomcat: session fixation when using FORM authentication
CVE-2020-1938	Important	Ghostcat - Apache Tomcat AJP File Read/Inclusion Vulnerability (CNVD-2020-10487)