Security update for openssl1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:0495-1 Final 1 1 2017-02-17T13:29:39Z current 2017-02-17T13:29:39Z 2017-02-17T13:29:39Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl1 This update for openssl1 fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed: - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) Bugs fixed: - fix crash in openssl speed (bsc#1000677) - call c_rehash in %post (bsc#1001707) - ship static libraries in the devel package (bsc#1022644) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). secsp3-openssl1-12991 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20170495-1/ Link for SUSE-SU-2017:0495-1 https://lists.suse.com/pipermail/sle-security-updates/2017-February/002653.html E-Mail link for SUSE-SU-2017:0495-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1000677 SUSE Bug 1000677 https://bugzilla.suse.com/1001707 SUSE Bug 1001707 https://bugzilla.suse.com/1001912 SUSE Bug 1001912 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1019334 SUSE Bug 1019334 https://bugzilla.suse.com/1021641 SUSE Bug 1021641 https://bugzilla.suse.com/1022085 SUSE Bug 1022085 https://bugzilla.suse.com/1022644 SUSE Bug 1022644 https://www.suse.com/security/cve/CVE-2016-2108/ SUSE CVE CVE-2016-2108 page https://www.suse.com/security/cve/CVE-2016-7056/ SUSE CVE CVE-2016-7056 page https://www.suse.com/security/cve/CVE-2016-8610/ SUSE CVE CVE-2016-8610 page https://www.suse.com/security/cve/CVE-2017-3731/ SUSE CVE CVE-2017-3731 page SUSE Linux Enterprise Server 11-SECURITY libopenssl1-devel-1.0.1g-0.57.1 libopenssl1_0_0-1.0.1g-0.57.1 libopenssl1_0_0-32bit-1.0.1g-0.57.1 libopenssl1_0_0-x86-1.0.1g-0.57.1 openssl1-1.0.1g-0.57.1 openssl1-doc-1.0.1g-0.57.1 libopenssl1-devel-1.0.1g-0.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libopenssl1_0_0-1.0.1g-0.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libopenssl1_0_0-32bit-1.0.1g-0.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libopenssl1_0_0-x86-1.0.1g-0.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY openssl1-1.0.1g-0.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY openssl1-doc-1.0.1g-0.57.1 as a component of SUSE Linux Enterprise Server 11-SECURITY The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. CVE-2016-2108 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1-devel-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-32bit-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-x86-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-doc-1.0.1g-0.57.1 important 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170495-1/ https://www.suse.com/security/cve/CVE-2016-2108.html CVE-2016-2108 https://bugzilla.suse.com/1001502 SUSE Bug 1001502 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977617 SUSE Bug 977617 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989345 SUSE Bug 989345 https://bugzilla.suse.com/996067 SUSE Bug 996067 A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys. CVE-2016-7056 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1-devel-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-32bit-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-x86-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-doc-1.0.1g-0.57.1 moderate 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170495-1/ https://www.suse.com/security/cve/CVE-2016-7056.html CVE-2016-7056 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1019334 SUSE Bug 1019334 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. CVE-2016-8610 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1-devel-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-32bit-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-x86-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-doc-1.0.1g-0.57.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170495-1/ https://www.suse.com/security/cve/CVE-2016-8610.html CVE-2016-8610 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1005879 SUSE Bug 1005879 https://bugzilla.suse.com/1110018 SUSE Bug 1110018 https://bugzilla.suse.com/1120592 SUSE Bug 1120592 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/982575 SUSE Bug 982575 If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k. CVE-2017-3731 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1-devel-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-32bit-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-x86-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-1.0.1g-0.57.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-doc-1.0.1g-0.57.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170495-1/ https://www.suse.com/security/cve/CVE-2017-3731.html CVE-2017-3731 https://bugzilla.suse.com/1021641 SUSE Bug 1021641 https://bugzilla.suse.com/1022085 SUSE Bug 1022085 https://bugzilla.suse.com/1064118 SUSE Bug 1064118 https://bugzilla.suse.com/1064119 SUSE Bug 1064119