Security update for compat-openssl098 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:0605-1 Final 1 1 2017-03-03T16:46:55Z current 2017-03-03T16:46:55Z 2017-03-03T16:46:55Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for compat-openssl098 This update for compat-openssl098 fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed: - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - degrade 3DES to MEDIUM in SSL2 (bsc#1001912) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) Bugs fixed: - fix crash in openssl speed (bsc#1000677) - don't attempt session resumption if no ticket is present and session ID length is zero (bsc#984663) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP1-2017-319,SUSE-SLE-DESKTOP-12-SP2-2017-319,SUSE-SLE-Module-Legacy-12-2017-319,SUSE-SLE-SAP-12-SP1-2017-319,SUSE-SLE-SAP-12-SP2-2017-319 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20170605-1/ Link for SUSE-SU-2017:0605-1 https://lists.suse.com/pipermail/sle-security-updates/2017-March/002678.html E-Mail link for SUSE-SU-2017:0605-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1000677 SUSE Bug 1000677 https://bugzilla.suse.com/1001912 SUSE Bug 1001912 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1019334 SUSE Bug 1019334 https://bugzilla.suse.com/1021641 SUSE Bug 1021641 https://bugzilla.suse.com/984663 SUSE Bug 984663 https://www.suse.com/security/cve/CVE-2016-2108/ SUSE CVE CVE-2016-2108 page https://www.suse.com/security/cve/CVE-2016-7056/ SUSE CVE CVE-2016-7056 page https://www.suse.com/security/cve/CVE-2016-8610/ SUSE CVE CVE-2016-8610 page SUSE Linux Enterprise Desktop 12 SP1 SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Module for Legacy 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl0_9_8-0.9.8j-105.1 libopenssl0_9_8-32bit-0.9.8j-105.1 libopenssl0_9_8-0.9.8j-105.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libopenssl0_9_8-32bit-0.9.8j-105.1 as a component of SUSE Linux Enterprise Desktop 12 SP1 libopenssl0_9_8-0.9.8j-105.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libopenssl0_9_8-32bit-0.9.8j-105.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libopenssl0_9_8-0.9.8j-105.1 as a component of SUSE Linux Enterprise Module for Legacy 12 libopenssl0_9_8-32bit-0.9.8j-105.1 as a component of SUSE Linux Enterprise Module for Legacy 12 libopenssl0_9_8-0.9.8j-105.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP1 libopenssl0_9_8-0.9.8j-105.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. CVE-2016-2108 SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-105.1 SUSE Linux Enterprise Desktop 12 SP2:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Desktop 12 SP2:libopenssl0_9_8-32bit-0.9.8j-105.1 SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-105.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl0_9_8-0.9.8j-105.1 important 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170605-1/ https://www.suse.com/security/cve/CVE-2016-2108.html CVE-2016-2108 https://bugzilla.suse.com/1001502 SUSE Bug 1001502 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977617 SUSE Bug 977617 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989345 SUSE Bug 989345 https://bugzilla.suse.com/996067 SUSE Bug 996067 A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys. CVE-2016-7056 SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-105.1 SUSE Linux Enterprise Desktop 12 SP2:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Desktop 12 SP2:libopenssl0_9_8-32bit-0.9.8j-105.1 SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-105.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl0_9_8-0.9.8j-105.1 moderate 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170605-1/ https://www.suse.com/security/cve/CVE-2016-7056.html CVE-2016-7056 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1019334 SUSE Bug 1019334 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. CVE-2016-8610 SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Desktop 12 SP1:libopenssl0_9_8-32bit-0.9.8j-105.1 SUSE Linux Enterprise Desktop 12 SP2:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Desktop 12 SP2:libopenssl0_9_8-32bit-0.9.8j-105.1 SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-105.1 SUSE Linux Enterprise Server for SAP Applications 12 SP1:libopenssl0_9_8-0.9.8j-105.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl0_9_8-0.9.8j-105.1 important 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20170605-1/ https://www.suse.com/security/cve/CVE-2016-8610.html CVE-2016-8610 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1005879 SUSE Bug 1005879 https://bugzilla.suse.com/1110018 SUSE Bug 1110018 https://bugzilla.suse.com/1120592 SUSE Bug 1120592 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 https://bugzilla.suse.com/1148697 SUSE Bug 1148697 https://bugzilla.suse.com/982575 SUSE Bug 982575