Security update for openssl1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2968-1 Final 1 1 2017-11-09T17:18:45Z current 2017-11-09T17:18:45Z 2017-11-09T17:18:45Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl1 This update for openssl1 fixes the following issues: Security issues fixed: - CVE-2017-3735: Malformed X.509 IPAdressFamily could cause OOB read (bsc#1056058) - adjust DEFAULT_SUSE to meet 1.0.2 and current state (bsc#1027908) - out of bounds read+crash in DES_fcrypt (bsc#1065363) - DEFAULT_SUSE cipher list is missing ECDHE-ECDSA ciphers (bsc#1055825) - Missing important ciphers in openssl 1.0.1i-47.1 (bsc#990592) Bug fixes: - support alternate root ca chains (bsc#1032261) - Require openssl1, so c_rehash1 is available during %post to hash the certificates (bsc#1057660) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). secsp3-openssl1-13343 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172968-1/ Link for SUSE-SU-2017:2968-1 https://lists.opensuse.org/opensuse-security-announce/2017-11/msg00015.html E-Mail link for SUSE-SU-2017:2968-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1027908 SUSE Bug 1027908 https://bugzilla.suse.com/1032261 SUSE Bug 1032261 https://bugzilla.suse.com/1055825 SUSE Bug 1055825 https://bugzilla.suse.com/1056058 SUSE Bug 1056058 https://bugzilla.suse.com/1057660 SUSE Bug 1057660 https://bugzilla.suse.com/1065363 SUSE Bug 1065363 https://bugzilla.suse.com/990592 SUSE Bug 990592 https://www.suse.com/security/cve/CVE-2017-3735/ SUSE CVE CVE-2017-3735 page SUSE Linux Enterprise Server 11-SECURITY libopenssl1-devel-1.0.1g-0.58.3.1 libopenssl1_0_0-1.0.1g-0.58.3.1 libopenssl1_0_0-32bit-1.0.1g-0.58.3.1 libopenssl1_0_0-x86-1.0.1g-0.58.3.1 openssl1-1.0.1g-0.58.3.1 openssl1-doc-1.0.1g-0.58.3.1 libopenssl1-devel-1.0.1g-0.58.3.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libopenssl1_0_0-1.0.1g-0.58.3.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libopenssl1_0_0-32bit-1.0.1g-0.58.3.1 as a component of SUSE Linux Enterprise Server 11-SECURITY libopenssl1_0_0-x86-1.0.1g-0.58.3.1 as a component of SUSE Linux Enterprise Server 11-SECURITY openssl1-1.0.1g-0.58.3.1 as a component of SUSE Linux Enterprise Server 11-SECURITY openssl1-doc-1.0.1g-0.58.3.1 as a component of SUSE Linux Enterprise Server 11-SECURITY While parsing an IPAddressFamily extension in an X.509 certificate, it is possible to do a one-byte overread. This would result in an incorrect text display of the certificate. This bug has been present since 2006 and is present in all versions of OpenSSL before 1.0.2m and 1.1.0g. CVE-2017-3735 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1-devel-1.0.1g-0.58.3.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-1.0.1g-0.58.3.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-32bit-1.0.1g-0.58.3.1 SUSE Linux Enterprise Server 11-SECURITY:libopenssl1_0_0-x86-1.0.1g-0.58.3.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-1.0.1g-0.58.3.1 SUSE Linux Enterprise Server 11-SECURITY:openssl1-doc-1.0.1g-0.58.3.1 important 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172968-1/ https://www.suse.com/security/cve/CVE-2017-3735.html CVE-2017-3735 https://bugzilla.suse.com/1056058 SUSE Bug 1056058