Security update for openssl SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2017:0487-1 Final 1 1 2017-02-16T20:42:09Z current 2017-02-16T20:42:09Z 2017-02-16T20:42:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl This update for openssl fixes the following issues contained in the OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641) Security issues fixed: - CVE-2016-7056: A local ECSDA P-256 timing attack that might have allowed key recovery was fixed (bsc#1019334) - CVE-2016-8610: A remote denial of service in SSL alert handling was fixed (bsc#1005878) - CVE-2016-2108: Added a missing commit for CVE-2016-2108, fixing the negative zero handling in the ASN.1 decoder (bsc#1004499) - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085, CVE-2017-3731) - Degrade the 3DES cipher to MEDIUM in SSLv2 (bsc#1001912) Bugs fixed: - fix crash in openssl speed (bsc#1000677) - fix ca-bundle path (bsc#1022271) This update was imported from the SUSE:SLE-12-SP1:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2017-02/msg00075.html E-Mail link for openSUSE-SU-2017:0487-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.1 libopenssl-devel-1.0.1i-21.1 libopenssl-devel-32bit-1.0.1i-21.1 libopenssl1_0_0-1.0.1i-21.1 libopenssl1_0_0-32bit-1.0.1i-21.1 libopenssl1_0_0-hmac-1.0.1i-21.1 libopenssl1_0_0-hmac-32bit-1.0.1i-21.1 openssl-1.0.1i-21.1 openssl-doc-1.0.1i-21.1 libopenssl-devel-1.0.1i-21.1 as a component of openSUSE Leap 42.1 libopenssl-devel-32bit-1.0.1i-21.1 as a component of openSUSE Leap 42.1 libopenssl1_0_0-1.0.1i-21.1 as a component of openSUSE Leap 42.1 libopenssl1_0_0-32bit-1.0.1i-21.1 as a component of openSUSE Leap 42.1 libopenssl1_0_0-hmac-1.0.1i-21.1 as a component of openSUSE Leap 42.1 libopenssl1_0_0-hmac-32bit-1.0.1i-21.1 as a component of openSUSE Leap 42.1 openssl-1.0.1i-21.1 as a component of openSUSE Leap 42.1 openssl-doc-1.0.1i-21.1 as a component of openSUSE Leap 42.1 The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. CVE-2016-2108 openSUSE Leap 42.1:libopenssl-devel-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl-devel-32bit-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-32bit-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-hmac-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-hmac-32bit-1.0.1i-21.1 openSUSE Leap 42.1:openssl-1.0.1i-21.1 openSUSE Leap 42.1:openssl-doc-1.0.1i-21.1 important 7.6 AV:N/AC:H/Au:N/C:C/I:C/A:C Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-02/msg00075.html https://www.suse.com/security/cve/CVE-2016-2108.html CVE-2016-2108 https://bugzilla.suse.com/1001502 SUSE Bug 1001502 https://bugzilla.suse.com/1004499 SUSE Bug 1004499 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/977584 SUSE Bug 977584 https://bugzilla.suse.com/977617 SUSE Bug 977617 https://bugzilla.suse.com/978492 SUSE Bug 978492 https://bugzilla.suse.com/989345 SUSE Bug 989345 https://bugzilla.suse.com/996067 SUSE Bug 996067 A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys. CVE-2016-7056 openSUSE Leap 42.1:libopenssl-devel-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl-devel-32bit-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-32bit-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-hmac-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-hmac-32bit-1.0.1i-21.1 openSUSE Leap 42.1:openssl-1.0.1i-21.1 openSUSE Leap 42.1:openssl-doc-1.0.1i-21.1 moderate 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-02/msg00075.html https://www.suse.com/security/cve/CVE-2016-7056.html CVE-2016-7056 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1018910 SUSE Bug 1018910 https://bugzilla.suse.com/1019334 SUSE Bug 1019334 A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. CVE-2016-8610 openSUSE Leap 42.1:libopenssl-devel-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl-devel-32bit-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-32bit-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-hmac-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-hmac-32bit-1.0.1i-21.1 openSUSE Leap 42.1:openssl-1.0.1i-21.1 openSUSE Leap 42.1:openssl-doc-1.0.1i-21.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-02/msg00075.html https://www.suse.com/security/cve/CVE-2016-8610.html CVE-2016-8610 https://bugzilla.suse.com/1005878 SUSE Bug 1005878 https://bugzilla.suse.com/1005879 SUSE Bug 1005879 https://bugzilla.suse.com/1120592 SUSE Bug 1120592 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 https://bugzilla.suse.com/982575 SUSE Bug 982575 If an SSL/TLS server or client is running on a 32-bit host, and a specific cipher is being used, then a truncated packet can cause that server or client to perform an out-of-bounds read, usually resulting in a crash. For OpenSSL 1.1.0, the crash can be triggered when using CHACHA20/POLY1305; users should upgrade to 1.1.0d. For Openssl 1.0.2, the crash can be triggered when using RC4-MD5; users who have not disabled that algorithm should update to 1.0.2k. CVE-2017-3731 openSUSE Leap 42.1:libopenssl-devel-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl-devel-32bit-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-32bit-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-hmac-1.0.1i-21.1 openSUSE Leap 42.1:libopenssl1_0_0-hmac-32bit-1.0.1i-21.1 openSUSE Leap 42.1:openssl-1.0.1i-21.1 openSUSE Leap 42.1:openssl-doc-1.0.1i-21.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2017-02/msg00075.html https://www.suse.com/security/cve/CVE-2017-3731.html CVE-2017-3731 https://bugzilla.suse.com/1021641 SUSE Bug 1021641 https://bugzilla.suse.com/1022085 SUSE Bug 1022085 https://bugzilla.suse.com/1025354 SUSE Bug 1025354 https://bugzilla.suse.com/1064118 SUSE Bug 1064118 https://bugzilla.suse.com/1064119 SUSE Bug 1064119