Security update for openssl-1_1 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:0062-1 Final 1 1 2020-01-15T13:13:17Z current 2020-01-15T13:13:17Z 2020-01-15T13:13:17Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl-1_1 This update for openssl-1_1 fixes the following issues: Security issue fixed: - CVE-2019-1551: Fixed an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli (bsc#1158809). Various FIPS related improvements were done: - FIPS: Backport SSH KDF to openssl (jsc#SLE-8789, bsc#1157775). - Port FIPS patches from SLE-12 (bsc#1158101). - Use SHA-2 in the RSA pairwise consistency check (bsc#1155346). This update was imported from the SUSE:SLE-15-SP1:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-62 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GEPOG743X2GF2BEAQ76DNOUCQOP4UXQC/ E-Mail link for openSUSE-SU-2020:0062-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1155346 SUSE Bug 1155346 https://bugzilla.suse.com/1157775 SUSE Bug 1157775 https://bugzilla.suse.com/1158101 SUSE Bug 1158101 https://bugzilla.suse.com/1158809 SUSE Bug 1158809 https://www.suse.com/security/cve/CVE-2019-1551/ SUSE CVE CVE-2019-1551 page openSUSE Leap 15.1 libopenssl-1_1-devel-1.1.0i-lp151.8.6.1 libopenssl-1_1-devel-32bit-1.1.0i-lp151.8.6.1 libopenssl1_1-1.1.0i-lp151.8.6.1 libopenssl1_1-32bit-1.1.0i-lp151.8.6.1 libopenssl1_1-hmac-1.1.0i-lp151.8.6.1 libopenssl1_1-hmac-32bit-1.1.0i-lp151.8.6.1 openssl-1_1-1.1.0i-lp151.8.6.1 openssl-1_1-doc-1.1.0i-lp151.8.6.1 libopenssl-1_1-devel-1.1.0i-lp151.8.6.1 as a component of openSUSE Leap 15.1 libopenssl-1_1-devel-32bit-1.1.0i-lp151.8.6.1 as a component of openSUSE Leap 15.1 libopenssl1_1-1.1.0i-lp151.8.6.1 as a component of openSUSE Leap 15.1 libopenssl1_1-32bit-1.1.0i-lp151.8.6.1 as a component of openSUSE Leap 15.1 libopenssl1_1-hmac-1.1.0i-lp151.8.6.1 as a component of openSUSE Leap 15.1 libopenssl1_1-hmac-32bit-1.1.0i-lp151.8.6.1 as a component of openSUSE Leap 15.1 openssl-1_1-1.1.0i-lp151.8.6.1 as a component of openSUSE Leap 15.1 openssl-1_1-doc-1.1.0i-lp151.8.6.1 as a component of openSUSE Leap 15.1 There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t). CVE-2019-1551 openSUSE Leap 15.1:libopenssl-1_1-devel-1.1.0i-lp151.8.6.1 openSUSE Leap 15.1:libopenssl-1_1-devel-32bit-1.1.0i-lp151.8.6.1 openSUSE Leap 15.1:libopenssl1_1-1.1.0i-lp151.8.6.1 openSUSE Leap 15.1:libopenssl1_1-32bit-1.1.0i-lp151.8.6.1 openSUSE Leap 15.1:libopenssl1_1-hmac-1.1.0i-lp151.8.6.1 openSUSE Leap 15.1:libopenssl1_1-hmac-32bit-1.1.0i-lp151.8.6.1 openSUSE Leap 15.1:openssl-1_1-1.1.0i-lp151.8.6.1 openSUSE Leap 15.1:openssl-1_1-doc-1.1.0i-lp151.8.6.1 moderate 5 AV:N/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GEPOG743X2GF2BEAQ76DNOUCQOP4UXQC/ https://www.suse.com/security/cve/CVE-2019-1551.html CVE-2019-1551 https://bugzilla.suse.com/1158809 SUSE Bug 1158809 https://bugzilla.suse.com/1205621 SUSE Bug 1205621