Security update for compat-openssl098 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0581-1 Final 1 1 2023-02-28T16:57:15Z current 2023-02-28T16:57:15Z 2023-02-28T16:57:15Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for compat-openssl098 This update for compat-openssl098 fixes the following issues: - CVE-2022-4304: Fixed timing Oracle in RSA Decryption (bsc#1207534). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP5-Azure-SAP-BYOS-2023-581,Image SLES12-SP5-Azure-SAP-On-Demand-2023-581,Image SLES12-SP5-EC2-SAP-BYOS-2023-581,Image SLES12-SP5-EC2-SAP-On-Demand-2023-581,Image SLES12-SP5-GCE-SAP-BYOS-2023-581,Image SLES12-SP5-GCE-SAP-On-Demand-2023-581,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2023-581,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2023-581,SUSE-2023-581,SUSE-SLE-Module-Legacy-12-2023-581,SUSE-SLE-SAP-12-SP4-2023-581,SUSE-SLE-SAP-12-SP5-2023-581 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230581-1/ Link for SUSE-SU-2023:0581-1 https://lists.suse.com/pipermail/sle-security-updates/2023-February/013933.html E-Mail link for SUSE-SU-2023:0581-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1207534 SUSE Bug 1207534 https://www.suse.com/security/cve/CVE-2022-4304/ SUSE CVE CVE-2022-4304 page Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Module for Legacy 12 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 libopenssl0_9_8-0.9.8j-106.42.1 libopenssl0_9_8-32bit-0.9.8j-106.42.1 libopenssl0_9_8-0.9.8j-106.42.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS libopenssl0_9_8-0.9.8j-106.42.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand libopenssl0_9_8-0.9.8j-106.42.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS libopenssl0_9_8-0.9.8j-106.42.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand libopenssl0_9_8-0.9.8j-106.42.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS libopenssl0_9_8-0.9.8j-106.42.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand libopenssl0_9_8-0.9.8j-106.42.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production libopenssl0_9_8-0.9.8j-106.42.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production libopenssl0_9_8-0.9.8j-106.42.1 as a component of SUSE Linux Enterprise Module for Legacy 12 libopenssl0_9_8-32bit-0.9.8j-106.42.1 as a component of SUSE Linux Enterprise Module for Legacy 12 libopenssl0_9_8-0.9.8j-106.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 libopenssl0_9_8-0.9.8j-106.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2022-4304 Image SLES12-SP5-Azure-SAP-BYOS:libopenssl0_9_8-0.9.8j-106.42.1 Image SLES12-SP5-Azure-SAP-On-Demand:libopenssl0_9_8-0.9.8j-106.42.1 Image SLES12-SP5-EC2-SAP-BYOS:libopenssl0_9_8-0.9.8j-106.42.1 Image SLES12-SP5-EC2-SAP-On-Demand:libopenssl0_9_8-0.9.8j-106.42.1 Image SLES12-SP5-GCE-SAP-BYOS:libopenssl0_9_8-0.9.8j-106.42.1 Image SLES12-SP5-GCE-SAP-On-Demand:libopenssl0_9_8-0.9.8j-106.42.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:libopenssl0_9_8-0.9.8j-106.42.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:libopenssl0_9_8-0.9.8j-106.42.1 SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-106.42.1 SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-106.42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:libopenssl0_9_8-0.9.8j-106.42.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:libopenssl0_9_8-0.9.8j-106.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230581-1/ https://www.suse.com/security/cve/CVE-2022-4304.html CVE-2022-4304 https://bugzilla.suse.com/1207534 SUSE Bug 1207534 https://bugzilla.suse.com/1210067 SUSE Bug 1210067 https://bugzilla.suse.com/1213146 SUSE Bug 1213146 https://bugzilla.suse.com/1213289 SUSE Bug 1213289 https://bugzilla.suse.com/1215014 SUSE Bug 1215014