Security update for openssl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0925-1 Final 1 1 2018-04-11T16:03:27Z current 2018-04-11T16:03:27Z 2018-04-11T16:03:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl This update for openssl fixes the following issues: - CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. (bsc#1087102). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2018-624,SUSE-SLE-DESKTOP-12-SP2-2018-624,SUSE-SLE-DESKTOP-12-SP3-2018-624,SUSE-SLE-RPI-12-SP2-2018-624,SUSE-SLE-SDK-12-SP2-2018-624,SUSE-SLE-SDK-12-SP3-2018-624,SUSE-SLE-SERVER-12-SP2-2018-624,SUSE-SLE-SERVER-12-SP3-2018-624 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180925-1/ Link for SUSE-SU-2018:0925-1 https://lists.suse.com/pipermail/sle-security-updates/2018-April/003886.html E-Mail link for SUSE-SU-2018:0925-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1087102 SUSE Bug 1087102 https://www.suse.com/security/cve/CVE-2018-0739/ SUSE CVE CVE-2018-0739 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 libopenssl-devel-1.0.2j-60.24.1 libopenssl1_0_0-1.0.2j-60.24.1 libopenssl1_0_0-32bit-1.0.2j-60.24.1 openssl-1.0.2j-60.24.1 libopenssl1_0_0-hmac-1.0.2j-60.24.1 openssl-doc-1.0.2j-60.24.1 libopenssl1_0_0-hmac-32bit-1.0.2j-60.24.1 libopenssl-devel-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libopenssl1_0_0-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libopenssl1_0_0-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 openssl-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Desktop 12 SP2 libopenssl-devel-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libopenssl1_0_0-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libopenssl1_0_0-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 openssl-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libopenssl-devel-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-hmac-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl1_0_0-hmac-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP2 openssl-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP2 openssl-doc-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP2 libopenssl-devel-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-hmac-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-hmac-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP3 openssl-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP3 openssl-doc-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl-devel-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libopenssl1_0_0-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libopenssl1_0_0-hmac-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 openssl-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 openssl-doc-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 libopenssl-devel-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl1_0_0-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl1_0_0-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl1_0_0-hmac-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl1_0_0-hmac-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 openssl-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 openssl-doc-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl-devel-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl1_0_0-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl1_0_0-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl1_0_0-hmac-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl1_0_0-hmac-32bit-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 openssl-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 openssl-doc-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl-devel-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 libopenssl-devel-1.0.2j-60.24.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n). CVE-2018-0739 SUSE Linux Enterprise Desktop 12 SP2:libopenssl-devel-1.0.2j-60.24.1 SUSE Linux Enterprise Desktop 12 SP2:libopenssl1_0_0-1.0.2j-60.24.1 SUSE Linux Enterprise Desktop 12 SP2:libopenssl1_0_0-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Desktop 12 SP2:openssl-1.0.2j-60.24.1 SUSE Linux Enterprise Desktop 12 SP3:libopenssl-devel-1.0.2j-60.24.1 SUSE Linux Enterprise Desktop 12 SP3:libopenssl1_0_0-1.0.2j-60.24.1 SUSE Linux Enterprise Desktop 12 SP3:libopenssl1_0_0-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Desktop 12 SP3:openssl-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP2:libopenssl-devel-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-hmac-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP2:libopenssl1_0_0-hmac-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP2:openssl-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP2:openssl-doc-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP3:libopenssl-devel-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-hmac-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-hmac-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP3:openssl-1.0.2j-60.24.1 SUSE Linux Enterprise Server 12 SP3:openssl-doc-1.0.2j-60.24.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libopenssl-devel-1.0.2j-60.24.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libopenssl1_0_0-1.0.2j-60.24.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:libopenssl1_0_0-hmac-1.0.2j-60.24.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:openssl-1.0.2j-60.24.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:openssl-doc-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl-devel-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl1_0_0-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl1_0_0-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl1_0_0-hmac-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl1_0_0-hmac-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:openssl-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:openssl-doc-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl-devel-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl1_0_0-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl1_0_0-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl1_0_0-hmac-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl1_0_0-hmac-32bit-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openssl-1.0.2j-60.24.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openssl-doc-1.0.2j-60.24.1 SUSE Linux Enterprise Software Development Kit 12 SP2:libopenssl-devel-1.0.2j-60.24.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libopenssl-devel-1.0.2j-60.24.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180925-1/ https://www.suse.com/security/cve/CVE-2018-0739.html CVE-2018-0739 https://bugzilla.suse.com/1087102 SUSE Bug 1087102 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 https://bugzilla.suse.com/1094291 SUSE Bug 1094291 https://bugzilla.suse.com/1108542 SUSE Bug 1108542