Security update for openssl-1_0_0 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0064-1 Final 1 1 2020-01-10T10:02:40Z current 2020-01-10T10:02:40Z 2020-01-10T10:02:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl-1_0_0 This update for openssl-1_0_0 fixes the following issues: Security issue fixed: - CVE-2019-1551: Fixed an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli (bsc#1158809). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SAP-Azure-LI-BYOS-Production-2020-64,Image SLES15-SAP-Azure-VLI-BYOS-Production-2020-64,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2020-64,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2020-64,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2020-64,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2020-64,Image SLES15-SP3-EC2-HVM-2020-64,Image SLES15-SP3-SAP-Azure-2020-64,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2020-64,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2020-64,Image SLES15-SP3-SAP-EC2-HVM-2020-64,Image SLES15-SP3-SAP-GCE-2020-64,Image SLES15-SP3-SAPCAL-Azure-2020-64,Image SLES15-SP3-SAPCAL-EC2-HVM-2020-64,Image SLES15-SP3-SAPCAL-GCE-2020-64,Image SLES15-SP4-SAP-Azure-LI-BYOS-2020-64,Image SLES15-SP4-SAP-Azure-LI-BYOS-Production-2020-64,Image SLES15-SP4-SAP-Azure-VLI-BYOS-2020-64,Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production-2020-64,Image SLES15-SP5-SAP-Azure-LI-BYOS-2020-64,Image SLES15-SP5-SAP-Azure-LI-BYOS-Production-2020-64,Image SLES15-SP5-SAP-Azure-VLI-BYOS-2020-64,Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production-2020-64,SUSE-2020-64,SUSE-SLE-Module-Development-Tools-OBS-15-2020-64,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-64,SUSE-SLE-Module-Legacy-15-2020-64,SUSE-SLE-Module-Legacy-15-SP1-2020-64,SUSE-Storage-6-2020-64 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200064-1/ Link for SUSE-SU-2020:0064-1 https://lists.suse.com/pipermail/sle-security-updates/2020-January/006323.html E-Mail link for SUSE-SU-2020:0064-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1158809 SUSE Bug 1158809 https://www.suse.com/security/cve/CVE-2019-1551/ SUSE CVE CVE-2019-1551 page Image SLES15-SAP-Azure-LI-BYOS-Production Image SLES15-SAP-Azure-VLI-BYOS-Production Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-EC2-HVM Image SLES15-SP3-SAP-Azure Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-EC2-HVM Image SLES15-SP3-SAP-GCE Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-EC2-HVM Image SLES15-SP3-SAPCAL-GCE Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Legacy 15 SUSE Linux Enterprise Module for Legacy 15 SP1 libopenssl1_0_0-1.0.2p-3.25.1 libopenssl-1_0_0-devel-1.0.2p-3.25.1 libopenssl-1_0_0-devel-32bit-1.0.2p-3.25.1 libopenssl-1_0_0-devel-64bit-1.0.2p-3.25.1 libopenssl1_0_0-32bit-1.0.2p-3.25.1 libopenssl1_0_0-64bit-1.0.2p-3.25.1 libopenssl1_0_0-hmac-1.0.2p-3.25.1 libopenssl1_0_0-hmac-32bit-1.0.2p-3.25.1 libopenssl1_0_0-hmac-64bit-1.0.2p-3.25.1 libopenssl1_0_0-steam-1.0.2p-3.25.1 libopenssl1_0_0-steam-32bit-1.0.2p-3.25.1 libopenssl1_0_0-steam-64bit-1.0.2p-3.25.1 openssl-1_0_0-1.0.2p-3.25.1 openssl-1_0_0-cavs-1.0.2p-3.25.1 openssl-1_0_0-doc-1.0.2p-3.25.1 libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SAP-Azure-LI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SAP-Azure-VLI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP3-EC2-HVM libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP3-SAP-Azure libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP3-SAP-EC2-HVM libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP3-SAP-GCE libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP3-SAPCAL-Azure libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP3-SAPCAL-GCE libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS libopenssl1_0_0-1.0.2p-3.25.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production libopenssl1_0_0-1.0.2p-3.25.1 as a component of SUSE Enterprise Storage 6 libopenssl-1_0_0-devel-1.0.2p-3.25.1 as a component of SUSE Linux Enterprise Module for Legacy 15 libopenssl1_0_0-1.0.2p-3.25.1 as a component of SUSE Linux Enterprise Module for Legacy 15 openssl-1_0_0-1.0.2p-3.25.1 as a component of SUSE Linux Enterprise Module for Legacy 15 libopenssl-1_0_0-devel-1.0.2p-3.25.1 as a component of SUSE Linux Enterprise Module for Legacy 15 SP1 libopenssl1_0_0-1.0.2p-3.25.1 as a component of SUSE Linux Enterprise Module for Legacy 15 SP1 openssl-1_0_0-1.0.2p-3.25.1 as a component of SUSE Linux Enterprise Module for Legacy 15 SP1 There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t). CVE-2019-1551 Image SLES15-SAP-Azure-LI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SAP-Azure-VLI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP3-EC2-HVM:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP3-SAP-Azure:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP3-SAP-EC2-HVM:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP3-SAP-GCE:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP3-SAPCAL-Azure:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP3-SAPCAL-EC2-HVM:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP3-SAPCAL-GCE:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:libopenssl1_0_0-1.0.2p-3.25.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:libopenssl1_0_0-1.0.2p-3.25.1 SUSE Enterprise Storage 6:libopenssl1_0_0-1.0.2p-3.25.1 SUSE Linux Enterprise Module for Legacy 15 SP1:libopenssl-1_0_0-devel-1.0.2p-3.25.1 SUSE Linux Enterprise Module for Legacy 15 SP1:libopenssl1_0_0-1.0.2p-3.25.1 SUSE Linux Enterprise Module for Legacy 15 SP1:openssl-1_0_0-1.0.2p-3.25.1 SUSE Linux Enterprise Module for Legacy 15:libopenssl-1_0_0-devel-1.0.2p-3.25.1 SUSE Linux Enterprise Module for Legacy 15:libopenssl1_0_0-1.0.2p-3.25.1 SUSE Linux Enterprise Module for Legacy 15:openssl-1_0_0-1.0.2p-3.25.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200064-1/ https://www.suse.com/security/cve/CVE-2019-1551.html CVE-2019-1551 https://bugzilla.suse.com/1158809 SUSE Bug 1158809 https://bugzilla.suse.com/1205621 SUSE Bug 1205621