Security update for rage-encryption SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:4060-1 Final 1 1 2023-10-12T08:05:57Z current 2023-10-12T08:05:57Z 2023-10-12T08:05:57Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rage-encryption This update for rage-encryption fixes the following issues: -CVE-2023-42811: chosen ciphertext attack possible against aes-gcm (bsc#1215657) * update vendor.tar.zst to contain aes-gcm >= 0.10.3 - Update to version 0.9.2+0: * CI: Ensure `apt` repository is up-to-date before installing build deps * CI: Build Linux releases using `ubuntu-20.04` runner * CI: Remove most uses of `actions-rs` actions - Update to version 0.9.2+0: * Fix changelog bugs and add missing entry * Document `PINENTRY_PROGRAM` environment variable * age: Add `Decryptor::new_async_buffered` * age: `impl AsyncBufRead for ArmoredReader` * Pre-initialize vectors when the capacity is known, or use arrays * Use `PINENTRY_PROGRAM` as environment variable for `pinentry` * Document why `impl AsyncWrite for StreamWriter` doesn't loop indefinitely * cargo update * cargo vet prune * Migrate to `cargo-vet 0.7` * build(deps): bump svenstaro/upload-release-action from 2.5.0 to 2.6.1 * Correct spelling in documentation * build(deps): bump codecov/codecov-action from 3.1.1 to 3.1.4 * StreamWriter AsyncWrite: fix usage with futures::io::copy() * rage: Use `Decryptor::new_buffered` * age: Add `Decryptor::new_buffered` * age: `impl BufRead for ArmoredReader` * Update Homebrew formula to v0.9.1 * feat/pinentry: Use env var to define pinentry binary - Update to version 0.9.1+0: * ssh: Fix parsing of OpenSSH private key format * ssh: Support `aes256-gcm@openssh.com` ciphers for encrypted keys * ssh: Add `aes256-gcm@openssh.com` cipher to test cases * ssh: Extract common key material derivation logic for encrypted keys * ssh: Use associated constants for key and IV sizes * ssh: Add test cases for encrypted keys - Add shell completions for fish and zsh. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-4060,SUSE-SLE-Module-Basesystem-15-SP5-2023-4060,openSUSE-SLE-15.5-2023-4060 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20234060-1/ Link for SUSE-SU-2023:4060-1 https://lists.suse.com/pipermail/sle-security-updates/2023-October/016645.html E-Mail link for SUSE-SU-2023:4060-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1215657 SUSE Bug 1215657 https://www.suse.com/security/cve/CVE-2023-42811/ SUSE CVE CVE-2023-42811 page SUSE Linux Enterprise Module for Basesystem 15 SP5 openSUSE Leap 15.5 rage-encryption-0.9.2+0-150500.3.3.1 rage-encryption-bash-completion-0.9.2+0-150500.3.3.1 rage-encryption-fish-completion-0.9.2+0-150500.3.3.1 rage-encryption-zsh-completion-0.9.2+0-150500.3.3.1 rage-encryption-0.9.2+0-150500.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 rage-encryption-bash-completion-0.9.2+0-150500.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 rage-encryption-0.9.2+0-150500.3.3.1 as a component of openSUSE Leap 15.5 rage-encryption-bash-completion-0.9.2+0-150500.3.3.1 as a component of openSUSE Leap 15.5 aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue. CVE-2023-42811 SUSE Linux Enterprise Module for Basesystem 15 SP5:rage-encryption-0.9.2+0-150500.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP5:rage-encryption-bash-completion-0.9.2+0-150500.3.3.1 openSUSE Leap 15.5:rage-encryption-0.9.2+0-150500.3.3.1 openSUSE Leap 15.5:rage-encryption-bash-completion-0.9.2+0-150500.3.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20234060-1/ https://www.suse.com/security/cve/CVE-2023-42811.html CVE-2023-42811 https://bugzilla.suse.com/1215654 SUSE Bug 1215654