Security update for openssl-1_1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0002-1 Final 1 1 2020-01-02T08:50:08Z current 2020-01-02T08:50:08Z 2020-01-02T08:50:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl-1_1 This update for openssl-1_1 fixes the following issues: Security issue fixed: - CVE-2019-1551: Fixed an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli (bsc#1158809). Various FIPS related improvements were done: - FIPS: Backport SSH KDF to openssl (jsc#SLE-8789, bsc#1157775). - Port FIPS patches from SLE-12 (bsc#1158101) - Use SHA-2 in the RSA pairwise consistency check (bsc#1155346) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sle15:15.0-2020-2,Image SLES15-Azure-BYOS-2020-2,Image SLES15-EC2-CHOST-HVM-BYOS-2020-2,Image SLES15-EC2-HVM-BYOS-2020-2,Image SLES15-GCE-BYOS-2020-2,Image SLES15-OCI-BYOS-2020-2,Image SLES15-SAP-Azure-2020-2,Image SLES15-SAP-Azure-BYOS-2020-2,Image SLES15-SAP-Azure-LI-BYOS-Production-2020-2,Image SLES15-SAP-Azure-VLI-BYOS-Production-2020-2,Image SLES15-SAP-EC2-HVM-2020-2,Image SLES15-SAP-EC2-HVM-BYOS-2020-2,Image SLES15-SAP-GCE-2020-2,Image SLES15-SAP-GCE-BYOS-2020-2,Image SLES15-SAP-OCI-BYOS-2020-2,SUSE-2020-2,SUSE-SLE-Module-Basesystem-15-2020-2,SUSE-SLE-Module-Development-Tools-OBS-15-2020-2 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200002-1/ Link for SUSE-SU-2020:0002-1 https://lists.suse.com/pipermail/sle-security-updates/2020-January/006297.html E-Mail link for SUSE-SU-2020:0002-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1155346 SUSE Bug 1155346 https://bugzilla.suse.com/1157775 SUSE Bug 1157775 https://bugzilla.suse.com/1158101 SUSE Bug 1158101 https://bugzilla.suse.com/1158809 SUSE Bug 1158809 https://www.suse.com/security/cve/CVE-2019-1551/ SUSE CVE CVE-2019-1551 page https://bugzilla.suse.com/SLE-8789 SUSE Bug SLE-8789 Container suse/sle15:15.0 Image SLES15-Azure-BYOS Image SLES15-EC2-CHOST-HVM-BYOS Image SLES15-EC2-HVM-BYOS Image SLES15-GCE-BYOS Image SLES15-OCI-BYOS Image SLES15-SAP-Azure Image SLES15-SAP-Azure-BYOS Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SAP-EC2-HVM Image SLES15-SAP-EC2-HVM-BYOS Image SLES15-SAP-GCE Image SLES15-SAP-GCE-BYOS Image SLES15-SAP-OCI-BYOS SUSE Linux Enterprise Module for Basesystem 15 libopenssl1_1-1.1.0i-4.27.1 openssl-1_1-1.1.0i-4.27.1 libopenssl-1_1-devel-1.1.0i-4.27.1 libopenssl-1_1-devel-32bit-1.1.0i-4.27.1 libopenssl-1_1-devel-64bit-1.1.0i-4.27.1 libopenssl1_1-32bit-1.1.0i-4.27.1 libopenssl1_1-64bit-1.1.0i-4.27.1 libopenssl1_1-hmac-1.1.0i-4.27.1 libopenssl1_1-hmac-32bit-1.1.0i-4.27.1 libopenssl1_1-hmac-64bit-1.1.0i-4.27.1 openssl-1_1-doc-1.1.0i-4.27.1 libopenssl1_1-1.1.0i-4.27.1 as a component of Container suse/sle15:15.0 openssl-1_1-1.1.0i-4.27.1 as a component of Container suse/sle15:15.0 libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-Azure-BYOS openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-Azure-BYOS libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-EC2-CHOST-HVM-BYOS openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-EC2-CHOST-HVM-BYOS libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-EC2-HVM-BYOS openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-EC2-HVM-BYOS libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-GCE-BYOS openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-GCE-BYOS libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-OCI-BYOS openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-OCI-BYOS libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-Azure openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-Azure libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-Azure-BYOS openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-Azure-BYOS libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-EC2-HVM openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-EC2-HVM libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-EC2-HVM-BYOS libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-GCE openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-GCE libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-GCE-BYOS openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-GCE-BYOS libopenssl1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-OCI-BYOS openssl-1_1-1.1.0i-4.27.1 as a component of Image SLES15-SAP-OCI-BYOS libopenssl-1_1-devel-1.1.0i-4.27.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 libopenssl1_1-1.1.0i-4.27.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 libopenssl1_1-32bit-1.1.0i-4.27.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 libopenssl1_1-hmac-1.1.0i-4.27.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 libopenssl1_1-hmac-32bit-1.1.0i-4.27.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 openssl-1_1-1.1.0i-4.27.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t). CVE-2019-1551 Container suse/sle15:15.0:libopenssl1_1-1.1.0i-4.27.1 Container suse/sle15:15.0:openssl-1_1-1.1.0i-4.27.1 Image SLES15-Azure-BYOS:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-Azure-BYOS:openssl-1_1-1.1.0i-4.27.1 Image SLES15-EC2-CHOST-HVM-BYOS:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-EC2-CHOST-HVM-BYOS:openssl-1_1-1.1.0i-4.27.1 Image SLES15-EC2-HVM-BYOS:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-EC2-HVM-BYOS:openssl-1_1-1.1.0i-4.27.1 Image SLES15-GCE-BYOS:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-GCE-BYOS:openssl-1_1-1.1.0i-4.27.1 Image SLES15-OCI-BYOS:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-OCI-BYOS:openssl-1_1-1.1.0i-4.27.1 Image SLES15-SAP-Azure-BYOS:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-SAP-Azure-BYOS:openssl-1_1-1.1.0i-4.27.1 Image SLES15-SAP-Azure-LI-BYOS-Production:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-SAP-Azure-LI-BYOS-Production:openssl-1_1-1.1.0i-4.27.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:openssl-1_1-1.1.0i-4.27.1 Image SLES15-SAP-Azure:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-SAP-Azure:openssl-1_1-1.1.0i-4.27.1 Image SLES15-SAP-EC2-HVM-BYOS:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-SAP-EC2-HVM-BYOS:openssl-1_1-1.1.0i-4.27.1 Image SLES15-SAP-EC2-HVM:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-SAP-EC2-HVM:openssl-1_1-1.1.0i-4.27.1 Image SLES15-SAP-GCE-BYOS:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-SAP-GCE-BYOS:openssl-1_1-1.1.0i-4.27.1 Image SLES15-SAP-GCE:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-SAP-GCE:openssl-1_1-1.1.0i-4.27.1 Image SLES15-SAP-OCI-BYOS:libopenssl1_1-1.1.0i-4.27.1 Image SLES15-SAP-OCI-BYOS:openssl-1_1-1.1.0i-4.27.1 SUSE Linux Enterprise Module for Basesystem 15:libopenssl-1_1-devel-1.1.0i-4.27.1 SUSE Linux Enterprise Module for Basesystem 15:libopenssl1_1-1.1.0i-4.27.1 SUSE Linux Enterprise Module for Basesystem 15:libopenssl1_1-32bit-1.1.0i-4.27.1 SUSE Linux Enterprise Module for Basesystem 15:libopenssl1_1-hmac-1.1.0i-4.27.1 SUSE Linux Enterprise Module for Basesystem 15:libopenssl1_1-hmac-32bit-1.1.0i-4.27.1 SUSE Linux Enterprise Module for Basesystem 15:openssl-1_1-1.1.0i-4.27.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200002-1/ https://www.suse.com/security/cve/CVE-2019-1551.html CVE-2019-1551 https://bugzilla.suse.com/1158809 SUSE Bug 1158809 https://bugzilla.suse.com/1205621 SUSE Bug 1205621