Security update for ovmf SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:2158-1 Final 1 1 2018-08-01T12:01:28Z current 2018-08-01T12:01:28Z 2018-08-01T12:01:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ovmf This update for ovmf provide the following fix: Security issues fixed: - CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth (bsc#1094290, bsc#1094291). Bug fixes: - Only use SLES-UEFI-CA-Certificate-2048.crt for the SUSE flavor to provide the better compatibility. (bsc#1077330) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SERVER-12-SP3-2018-1470 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20182158-1/ Link for SUSE-SU-2018:2158-1 https://lists.suse.com/pipermail/sle-security-updates/2018-August/004363.html E-Mail link for SUSE-SU-2018:2158-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1077330 SUSE Bug 1077330 https://bugzilla.suse.com/1094290 SUSE Bug 1094290 https://bugzilla.suse.com/1094291 SUSE Bug 1094291 https://www.suse.com/security/cve/CVE-2018-0739/ SUSE CVE CVE-2018-0739 page SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP3 ovmf-2017+git1492060560.b6d11d7c46-4.9.4 ovmf-tools-2017+git1492060560.b6d11d7c46-4.9.4 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-4.9.4 qemu-uefi-aarch64-2017+git1492060560.b6d11d7c46-4.9.4 ovmf-2017+git1492060560.b6d11d7c46-4.9.4 as a component of SUSE Linux Enterprise Server 12 SP3 ovmf-tools-2017+git1492060560.b6d11d7c46-4.9.4 as a component of SUSE Linux Enterprise Server 12 SP3 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-4.9.4 as a component of SUSE Linux Enterprise Server 12 SP3 qemu-uefi-aarch64-2017+git1492060560.b6d11d7c46-4.9.4 as a component of SUSE Linux Enterprise Server 12 SP3 ovmf-2017+git1492060560.b6d11d7c46-4.9.4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 ovmf-tools-2017+git1492060560.b6d11d7c46-4.9.4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-4.9.4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 qemu-uefi-aarch64-2017+git1492060560.b6d11d7c46-4.9.4 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n). CVE-2018-0739 SUSE Linux Enterprise Server 12 SP3:ovmf-2017+git1492060560.b6d11d7c46-4.9.4 SUSE Linux Enterprise Server 12 SP3:ovmf-tools-2017+git1492060560.b6d11d7c46-4.9.4 SUSE Linux Enterprise Server 12 SP3:qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-4.9.4 SUSE Linux Enterprise Server 12 SP3:qemu-uefi-aarch64-2017+git1492060560.b6d11d7c46-4.9.4 SUSE Linux Enterprise Server for SAP Applications 12 SP3:ovmf-2017+git1492060560.b6d11d7c46-4.9.4 SUSE Linux Enterprise Server for SAP Applications 12 SP3:ovmf-tools-2017+git1492060560.b6d11d7c46-4.9.4 SUSE Linux Enterprise Server for SAP Applications 12 SP3:qemu-ovmf-x86_64-2017+git1492060560.b6d11d7c46-4.9.4 SUSE Linux Enterprise Server for SAP Applications 12 SP3:qemu-uefi-aarch64-2017+git1492060560.b6d11d7c46-4.9.4 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20182158-1/ https://www.suse.com/security/cve/CVE-2018-0739.html CVE-2018-0739 https://bugzilla.suse.com/1087102 SUSE Bug 1087102 https://bugzilla.suse.com/1089997 SUSE Bug 1089997 https://bugzilla.suse.com/1094291 SUSE Bug 1094291 https://bugzilla.suse.com/1108542 SUSE Bug 1108542