Security update for nagios-nrpe
Announcement ID: | SUSE-SU-2018:1768-1 |
Rating: | moderate |
References: | #938906 |
Affected Products: |
An update that fixes one vulnerability is now available.
Description:
This update for nagios-nrpe fixes one issue.
This security issue was fixed:
- CVE-2015-4000: Prevent Logjam. The TLS protocol 1.2 and earlier, when a
DHE_EXPORT ciphersuite is enabled on a server but not on a client, did
not properly convey a DHE_EXPORT choice, which allowed man-in-the-middle
attackers to conduct cipher-downgrade attacks by rewriting a ClientHello
with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with
DHE_EXPORT replaced by DHE (bsc#938906).
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11-SP4:
zypper in -t patch slessp4-nagios-nrpe-13667=1
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-nagios-nrpe-13667=1
Package List:
- SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- nagios-nrpe-2.12-24.4.10.3.3
- nagios-nrpe-doc-2.12-24.4.10.3.3
- nagios-plugins-nrpe-2.12-24.4.10.3.3
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- nagios-nrpe-debuginfo-2.12-24.4.10.3.3
- nagios-nrpe-debugsource-2.12-24.4.10.3.3