Security update for openssl-1_1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:0954-1 Final 1 1 2021-03-25T15:11:37Z current 2021-03-25T15:11:37Z 2021-03-25T15:11:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl-1_1 This update for openssl-1_1 fixes the following security issue: * CVE-2021-3449: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension but includes a signature_algorithms_cert extension, then a NULL pointer dereference will result, leading to a crash and a denial of service attack. OpenSSL TLS clients are not impacted by this issue. [bsc#1183852] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-BYOS-2021-954,Image SLES12-SP5-Azure-Basic-On-Demand-2021-954,Image SLES12-SP5-Azure-HPC-BYOS-2021-954,Image SLES12-SP5-Azure-HPC-On-Demand-2021-954,Image SLES12-SP5-Azure-SAP-BYOS-2021-954,Image SLES12-SP5-Azure-SAP-On-Demand-2021-954,Image SLES12-SP5-Azure-Standard-On-Demand-2021-954,Image SLES12-SP5-EC2-BYOS-2021-954,Image SLES12-SP5-EC2-ECS-On-Demand-2021-954,Image SLES12-SP5-EC2-On-Demand-2021-954,Image SLES12-SP5-EC2-SAP-BYOS-2021-954,Image SLES12-SP5-EC2-SAP-On-Demand-2021-954,Image SLES12-SP5-GCE-BYOS-2021-954,Image SLES12-SP5-GCE-On-Demand-2021-954,Image SLES12-SP5-GCE-SAP-BYOS-2021-954,Image SLES12-SP5-GCE-SAP-On-Demand-2021-954,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2021-954,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2021-954,SUSE-2021-954,SUSE-OpenStack-Cloud-9-2021-954,SUSE-OpenStack-Cloud-Crowbar-9-2021-954,SUSE-SLE-SAP-12-SP4-2021-954,SUSE-SLE-SDK-12-SP5-2021-954,SUSE-SLE-SERVER-12-SP4-LTSS-2021-954,SUSE-SLE-SERVER-12-SP5-2021-954 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20210954-1/ Link for SUSE-SU-2021:0954-1 https://lists.suse.com/pipermail/sle-security-updates/2021-March/008558.html E-Mail link for SUSE-SU-2021:0954-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1183852 SUSE Bug 1183852 https://www.suse.com/security/cve/CVE-2021-3449/ SUSE CVE CVE-2021-3449 page Image SLES12-SP5-Azure-BYOS Image SLES12-SP5-Azure-Basic-On-Demand Image SLES12-SP5-Azure-HPC-BYOS Image SLES12-SP5-Azure-HPC-On-Demand Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-Azure-Standard-On-Demand Image SLES12-SP5-EC2-BYOS Image SLES12-SP5-EC2-ECS-On-Demand Image SLES12-SP5-EC2-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-BYOS Image SLES12-SP5-GCE-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 libopenssl1_1-1.1.1d-2.33.1 libopenssl-1_1-devel-1.1.1d-2.33.1 libopenssl-1_1-devel-32bit-1.1.1d-2.33.1 libopenssl-1_1-devel-64bit-1.1.1d-2.33.1 libopenssl1_1-32bit-1.1.1d-2.33.1 libopenssl1_1-64bit-1.1.1d-2.33.1 openssl-1_1-1.1.1d-2.33.1 openssl-1_1-doc-1.1.1d-2.33.1 libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-Azure-BYOS libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-Azure-Basic-On-Demand libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-Azure-HPC-BYOS libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-Azure-HPC-On-Demand libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-Azure-Standard-On-Demand libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-EC2-BYOS libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-EC2-ECS-On-Demand libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-EC2-On-Demand libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-GCE-BYOS libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-GCE-On-Demand libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libopenssl1_1-1.1.1d-2.33.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libopenssl1_1-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libopenssl1_1-32bit-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS openssl-1_1-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS libopenssl1_1-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server 12 SP5 libopenssl1_1-32bit-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server 12 SP5 openssl-1_1-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server 12 SP5 libopenssl1_1-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libopenssl1_1-32bit-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 openssl-1_1-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libopenssl1_1-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libopenssl1_1-32bit-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 openssl-1_1-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 libopenssl-1_1-devel-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libopenssl-1_1-devel-32bit-1.1.1d-2.33.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 libopenssl1_1-1.1.1d-2.33.1 as a component of SUSE OpenStack Cloud 9 libopenssl1_1-32bit-1.1.1d-2.33.1 as a component of SUSE OpenStack Cloud 9 openssl-1_1-1.1.1d-2.33.1 as a component of SUSE OpenStack Cloud 9 libopenssl1_1-1.1.1d-2.33.1 as a component of SUSE OpenStack Cloud Crowbar 9 libopenssl1_1-32bit-1.1.1d-2.33.1 as a component of SUSE OpenStack Cloud Crowbar 9 openssl-1_1-1.1.1d-2.33.1 as a component of SUSE OpenStack Cloud Crowbar 9 An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j). CVE-2021-3449 Image SLES12-SP5-Azure-BYOS:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-Azure-Basic-On-Demand:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-Azure-HPC-BYOS:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-Azure-HPC-On-Demand:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-Azure-SAP-BYOS:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-Azure-SAP-On-Demand:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-Azure-Standard-On-Demand:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-EC2-BYOS:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-EC2-ECS-On-Demand:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-EC2-On-Demand:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-EC2-SAP-BYOS:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-EC2-SAP-On-Demand:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-GCE-BYOS:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-GCE-On-Demand:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-GCE-SAP-BYOS:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-GCE-SAP-On-Demand:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libopenssl1_1-1.1.1d-2.33.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libopenssl1_1-1.1.1d-2.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libopenssl1_1-1.1.1d-2.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:libopenssl1_1-32bit-1.1.1d-2.33.1 SUSE Linux Enterprise Server 12 SP4-LTSS:openssl-1_1-1.1.1d-2.33.1 SUSE Linux Enterprise Server 12 SP5:libopenssl1_1-1.1.1d-2.33.1 SUSE Linux Enterprise Server 12 SP5:libopenssl1_1-32bit-1.1.1d-2.33.1 SUSE Linux Enterprise Server 12 SP5:openssl-1_1-1.1.1d-2.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libopenssl1_1-1.1.1d-2.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libopenssl1_1-32bit-1.1.1d-2.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:openssl-1_1-1.1.1d-2.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libopenssl1_1-1.1.1d-2.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libopenssl1_1-32bit-1.1.1d-2.33.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:openssl-1_1-1.1.1d-2.33.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libopenssl-1_1-devel-1.1.1d-2.33.1 SUSE Linux Enterprise Software Development Kit 12 SP5:libopenssl-1_1-devel-32bit-1.1.1d-2.33.1 SUSE OpenStack Cloud 9:libopenssl1_1-1.1.1d-2.33.1 SUSE OpenStack Cloud 9:libopenssl1_1-32bit-1.1.1d-2.33.1 SUSE OpenStack Cloud 9:openssl-1_1-1.1.1d-2.33.1 SUSE OpenStack Cloud Crowbar 9:libopenssl1_1-1.1.1d-2.33.1 SUSE OpenStack Cloud Crowbar 9:libopenssl1_1-32bit-1.1.1d-2.33.1 SUSE OpenStack Cloud Crowbar 9:openssl-1_1-1.1.1d-2.33.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210954-1/ https://www.suse.com/security/cve/CVE-2021-3449.html CVE-2021-3449 https://bugzilla.suse.com/1183852 SUSE Bug 1183852