Security update for openssl-1_1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2622-1 Final 1 1 2023-06-23T11:42:27Z current 2023-06-23T11:42:27Z 2023-06-23T11:42:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl-1_1 This update for openssl-1_1 fixes the following issues: - CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case (bsc#1207534). - Update further expiring certificates that affect tests [bsc#1201627] * Add openssl-Update-further-expiring-certificates.patch The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sle15:15.1-2023-2622,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2023-2622,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2023-2622,SUSE-2023-2622,SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-2622,SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-2622,SUSE-SLE-Product-SLES_SAP-15-SP1-2023-2622 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232622-1/ Link for SUSE-SU-2023:2622-1 https://lists.suse.com/pipermail/sle-updates/2023-June/030012.html E-Mail link for SUSE-SU-2023:2622-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1201627 SUSE Bug 1201627 https://bugzilla.suse.com/1207534 SUSE Bug 1207534 https://www.suse.com/security/cve/CVE-2022-4304/ SUSE CVE CVE-2022-4304 page Container suse/sle15:15.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP1 libopenssl1_1-1.1.0i-150100.14.56.1 openssl-1_1-1.1.0i-150100.14.56.1 libopenssl1_1-32bit-1.1.0i-150100.14.56.1 libopenssl-1_1-devel-1.1.0i-150100.14.56.1 libopenssl-1_1-devel-32bit-1.1.0i-150100.14.56.1 libopenssl-1_1-devel-64bit-1.1.0i-150100.14.56.1 libopenssl1_1-64bit-1.1.0i-150100.14.56.1 libopenssl1_1-hmac-1.1.0i-150100.14.56.1 libopenssl1_1-hmac-32bit-1.1.0i-150100.14.56.1 libopenssl1_1-hmac-64bit-1.1.0i-150100.14.56.1 openssl-1_1-doc-1.1.0i-150100.14.56.1 libopenssl1_1-1.1.0i-150100.14.56.1 as a component of Container suse/sle15:15.1 openssl-1_1-1.1.0i-150100.14.56.1 as a component of Container suse/sle15:15.1 libopenssl1_1-1.1.0i-150100.14.56.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production libopenssl1_1-32bit-1.1.0i-150100.14.56.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production openssl-1_1-1.1.0i-150100.14.56.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production libopenssl1_1-1.1.0i-150100.14.56.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production libopenssl1_1-32bit-1.1.0i-150100.14.56.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production openssl-1_1-1.1.0i-150100.14.56.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production libopenssl-1_1-devel-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libopenssl-1_1-devel-32bit-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libopenssl1_1-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libopenssl1_1-32bit-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libopenssl1_1-hmac-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libopenssl1_1-hmac-32bit-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS openssl-1_1-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS libopenssl-1_1-devel-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libopenssl-1_1-devel-32bit-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libopenssl1_1-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libopenssl1_1-32bit-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libopenssl1_1-hmac-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libopenssl1_1-hmac-32bit-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS openssl-1_1-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS libopenssl-1_1-devel-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libopenssl-1_1-devel-32bit-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libopenssl1_1-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libopenssl1_1-32bit-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libopenssl1_1-hmac-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 libopenssl1_1-hmac-32bit-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 openssl-1_1-1.1.0i-150100.14.56.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. CVE-2022-4304 Container suse/sle15:15.1:libopenssl1_1-1.1.0i-150100.14.56.1 Container suse/sle15:15.1:openssl-1_1-1.1.0i-150100.14.56.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libopenssl1_1-1.1.0i-150100.14.56.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:libopenssl1_1-32bit-1.1.0i-150100.14.56.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:openssl-1_1-1.1.0i-150100.14.56.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libopenssl1_1-1.1.0i-150100.14.56.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:libopenssl1_1-32bit-1.1.0i-150100.14.56.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:openssl-1_1-1.1.0i-150100.14.56.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libopenssl-1_1-devel-1.1.0i-150100.14.56.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libopenssl-1_1-devel-32bit-1.1.0i-150100.14.56.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libopenssl1_1-1.1.0i-150100.14.56.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libopenssl1_1-32bit-1.1.0i-150100.14.56.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libopenssl1_1-hmac-1.1.0i-150100.14.56.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:libopenssl1_1-hmac-32bit-1.1.0i-150100.14.56.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:openssl-1_1-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libopenssl-1_1-devel-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libopenssl-1_1-devel-32bit-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libopenssl1_1-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libopenssl1_1-32bit-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libopenssl1_1-hmac-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server 15 SP1-LTSS:libopenssl1_1-hmac-32bit-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server 15 SP1-LTSS:openssl-1_1-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libopenssl-1_1-devel-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libopenssl-1_1-devel-32bit-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libopenssl1_1-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libopenssl1_1-32bit-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libopenssl1_1-hmac-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:libopenssl1_1-hmac-32bit-1.1.0i-150100.14.56.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:openssl-1_1-1.1.0i-150100.14.56.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232622-1/ https://www.suse.com/security/cve/CVE-2022-4304.html CVE-2022-4304 https://bugzilla.suse.com/1207534 SUSE Bug 1207534 https://bugzilla.suse.com/1210067 SUSE Bug 1210067 https://bugzilla.suse.com/1213146 SUSE Bug 1213146 https://bugzilla.suse.com/1213289 SUSE Bug 1213289 https://bugzilla.suse.com/1215014 SUSE Bug 1215014