Ranjivosti programskog paketa OpenSSL

SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1181-1
Rating: important
References: #929678 #931698 #934487 #934489 #934491
Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790
CVE-2015-4000
Affected Products:
SLE CLIENT TOOLS 10 for x86_64
SLE CLIENT TOOLS 10 for s390x
SLE CLIENT TOOLS 10
______________________________________________________________________________

An update that solves four vulnerabilities and has one
errata is now available.

Description:

OpenSSL was updated to fix several security issues.

Additional changes:

In the default SSL cipher string EXPORT ciphers are now disabled. This will
only get active if applications get rebuilt and actually use this string.
(bnc#931698)

Security Issues:

Package List:

– SLE CLIENT TOOLS 10 for x86_64 (x86_64):

openssl-0.9.8a-18.92.1
openssl-32bit-0.9.8a-18.92.1

– SLE CLIENT TOOLS 10 for s390x (s390x):

openssl-0.9.8a-18.92.1
openssl-32bit-0.9.8a-18.92.1

– SLE CLIENT TOOLS 10 (i586):

openssl-0.9.8a-18.92.1

References:

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1182-1
Rating: important
References: #879179 #929678 #931698 #933898 #933911 #934487
#934489 #934491 #934493
Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790
CVE-2015-1791 CVE-2015-1792 CVE-2015-3216
CVE-2015-4000
Affected Products:
SUSE Studio Onsite 1.3
SUSE Manager 1.7 for SLE 11 SP2
______________________________________________________________________________

An update that solves 7 vulnerabilities and has two fixes
is now available.

Description:

OpenSSL 0.9.8k was updated to fix several security issues.

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed
by rejecting connections with DH parameters shorter than 1024 bits.
We now also generate 2048-bit DH parameters by default.
* CVE-2015-1788: Malformed ECParameters could cause an infinite loop.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
was fixed.
* CVE-2015-1792: A CMS verification infinite loop when using an
unknown hash function was fixed.
* CVE-2015-1791: Fixed a race condition in NewSessionTicket creation.
* CVE-2015-3216: Fixed a potential crash in ssleay_rand_bytes due to
locking regression.
* fixed a timing side channel in RSA decryption (bnc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
This will only get active if applications get rebuilt and actually
use this string. (bnc#931698)
* Added the ECC ciphersuites to the DEFAULT cipher class (bnc#879179)

Security Issues:

* CVE-2015-1788
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788>
* CVE-2015-1789
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-1791
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1791>
* CVE-2015-1792
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1792>
* CVE-2015-3216
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3216>
* CVE-2015-4000
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Studio Onsite 1.3:

zypper in -t patch slestso13-libopenssl-devel=10780

– SUSE Manager 1.7 for SLE 11 SP2:

zypper in -t patch sleman17sp2-libopenssl-devel=10780

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Studio Onsite 1.3 (x86_64):

libopenssl-devel-0.9.8j-0.72.1

– SUSE Manager 1.7 for SLE 11 SP2 (x86_64):

libopenssl0_9_8-0.9.8j-0.72.1
libopenssl0_9_8-32bit-0.9.8j-0.72.1
libopenssl0_9_8-hmac-0.9.8j-0.72.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1
openssl-0.9.8j-0.72.1
openssl-doc-0.9.8j-0.72.1

References:

https://www.suse.com/security/cve/CVE-2015-1788.html
https://www.suse.com/security/cve/CVE-2015-1789.html
https://www.suse.com/security/cve/CVE-2015-1790.html
https://www.suse.com/security/cve/CVE-2015-1791.html
https://www.suse.com/security/cve/CVE-2015-1792.html
https://www.suse.com/security/cve/CVE-2015-3216.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://bugzilla.suse.com/879179
https://bugzilla.suse.com/929678
https://bugzilla.suse.com/931698
https://bugzilla.suse.com/933898
https://bugzilla.suse.com/933911
https://bugzilla.suse.com/934487
https://bugzilla.suse.com/934489
https://bugzilla.suse.com/934491
https://bugzilla.suse.com/934493
https://download.suse.com/patch/finder/?keywords=5f8d475ae46705d05176f539f9c56674

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1183-1
Rating: important
References: #929678 #931698 #934489 #934491
Cross-References: CVE-2015-1789 CVE-2015-1790 CVE-2015-4000

Affected Products:
SUSE Linux Enterprise for SAP Applications 11 SP2
SUSE Linux Enterprise for SAP Applications 11 SP1
______________________________________________________________________________

An update that solves three vulnerabilities and has one
errata is now available.

Description:

OpenSSL was updated to fix several security issues.

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed
by rejecting connections with DH parameters shorter than 1024 bits.
We now also generate 2048-bit DH parameters by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
was fixed.
* fixed a timing side channel in RSA decryption (bnc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
This will only get active if applications get rebuilt and actually
use this string. (bnc#931698)

Security Issues:

* CVE-2015-1789
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-4000
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise for SAP Applications 11 SP2:

zypper in -t patch slesapp2-compat-openssl097g=10802

– SUSE Linux Enterprise for SAP Applications 11 SP1:

zypper in -t patch slesapp1-compat-openssl097g=10793

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise for SAP Applications 11 SP2 (x86_64):

compat-openssl097g-0.9.7g-146.22.31.1
compat-openssl097g-32bit-0.9.7g-146.22.31.1

– SUSE Linux Enterprise for SAP Applications 11 SP1 (x86_64):

compat-openssl097g-0.9.7g-146.22.31.1
compat-openssl097g-32bit-0.9.7g-146.22.31.1

References:

https://www.suse.com/security/cve/CVE-2015-1789.html
https://www.suse.com/security/cve/CVE-2015-1790.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://bugzilla.suse.com/929678
https://bugzilla.suse.com/931698
https://bugzilla.suse.com/934489
https://bugzilla.suse.com/934491
https://download.suse.com/patch/finder/?keywords=988a9debe1ac4ac25cd6b815d5382398
https://download.suse.com/patch/finder/?keywords=b18733973cc66be5941bc1514b5749d4

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1184-1
Rating: important
References: #929678 #931698 #933911 #934487 #934489 #934491
#934493
Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790
CVE-2015-1791 CVE-2015-1792 CVE-2015-3216
CVE-2015-4000
Affected Products:
SUSE Linux Enterprise Server 11 SP1 LTSS
______________________________________________________________________________

An update that fixes 7 vulnerabilities is now available. It
includes one version update.

Description:

OpenSSL 0.9.8j was updated to fix several security issues.

Additional changes:

Security Issues:

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Server 11 SP1 LTSS:

zypper in -t patch slessp1-libopenssl-devel=10794

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 0.9.8j]:

libopenssl-devel-0.9.8j-0.72.1
libopenssl0_9_8-0.9.8j-0.72.1
libopenssl0_9_8-hmac-0.9.8j-0.72.1
openssl-0.9.8j-0.72.1
openssl-doc-0.9.8j-0.72.1

– SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 0.9.8j]:

libopenssl0_9_8-32bit-0.9.8j-0.72.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1

References:

https://www.suse.com/security/cve/CVE-2015-1788.html
https://www.suse.com/security/cve/CVE-2015-1789.html
https://www.suse.com/security/cve/CVE-2015-1790.html
https://www.suse.com/security/cve/CVE-2015-1791.html
https://www.suse.com/security/cve/CVE-2015-1792.html
https://www.suse.com/security/cve/CVE-2015-3216.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://bugzilla.suse.com/929678
https://bugzilla.suse.com/931698
https://bugzilla.suse.com/933911
https://bugzilla.suse.com/934487
https://bugzilla.suse.com/934489
https://bugzilla.suse.com/934491
https://bugzilla.suse.com/934493
https://download.suse.com/patch/finder/?keywords=ab1c52f77471cf8a61e7eae79f57f9bf

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1185-1
Rating: important
References: #929678 #931698 #933911 #934487 #934489 #934491
#934493 #934494
Cross-References: CVE-2014-8176 CVE-2015-1788 CVE-2015-1789
CVE-2015-1790 CVE-2015-1791 CVE-2015-1792
CVE-2015-4000
Affected Products:
SUSE Linux Enterprise Security Module 11 SP3
______________________________________________________________________________

An update that solves 7 vulnerabilities and has one errata
is now available.

Description:

OpenSSL 1.0.1 was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed
by rejecting connections with DH parameters shorter than 1024 bits.
2048-bit DH parameters are now generated by default.
* CVE-2015-1788: Malformed ECParameters could cause an infinite loop.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
was fixed.
* CVE-2015-1792: A CMS verification infinite loop when using an
unknown hash function was fixed.
* CVE-2015-1791: Fixed a race condition in NewSessionTicket creation.
* CVE-2014-8176: Fixed an invalid free in DTLS.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Security Issues:

* CVE-2014-8176
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8176>
* CVE-2015-1788
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1788>
* CVE-2015-1789
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1789>
* CVE-2015-1790
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1790>
* CVE-2015-1791
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1791>
* CVE-2015-1792
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1792>
* CVE-2015-4000
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4000>

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Security Module 11 SP3:

zypper in -t patch secsp3-libopenssl1-devel=10778

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Security Module 11 SP3 (i586 ia64 ppc64 s390x x86_64):

libopenssl1-devel-1.0.1g-0.30.1
libopenssl1_0_0-1.0.1g-0.30.1
openssl1-1.0.1g-0.30.1
openssl1-doc-1.0.1g-0.30.1

– SUSE Linux Enterprise Security Module 11 SP3 (ppc64 s390x x86_64):

libopenssl1_0_0-32bit-1.0.1g-0.30.1

– SUSE Linux Enterprise Security Module 11 SP3 (ia64):

libopenssl1_0_0-x86-1.0.1g-0.30.1

References:

https://www.suse.com/security/cve/CVE-2014-8176.html
https://www.suse.com/security/cve/CVE-2015-1788.html
https://www.suse.com/security/cve/CVE-2015-1789.html
https://www.suse.com/security/cve/CVE-2015-1790.html
https://www.suse.com/security/cve/CVE-2015-1791.html
https://www.suse.com/security/cve/CVE-2015-1792.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://bugzilla.suse.com/929678
https://bugzilla.suse.com/931698
https://bugzilla.suse.com/933911
https://bugzilla.suse.com/934487
https://bugzilla.suse.com/934489
https://bugzilla.suse.com/934491
https://bugzilla.suse.com/934493
https://bugzilla.suse.com/934494
https://download.suse.com/patch/finder/?keywords=5afbe87912753d6ca074e9e870b2093c

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1184-2
Rating: important
References: #929678 #931698 #933911 #934487 #934489 #934491
#934493
Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790
CVE-2015-1791 CVE-2015-1792 CVE-2015-3216
CVE-2015-4000
Affected Products:
SUSE Linux Enterprise Server 11 SP2 LTSS
______________________________________________________________________________

An update that fixes 7 vulnerabilities is now available.

Description:

OpenSSL 0.9.8j was updated to fix several security issues.

Additional changes:

Security Issues:

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Server 11 SP2 LTSS:

zypper in -t patch slessp2-libopenssl-devel=10795

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64):

libopenssl-devel-0.9.8j-0.72.1
libopenssl0_9_8-0.9.8j-0.72.1
libopenssl0_9_8-hmac-0.9.8j-0.72.1
openssl-0.9.8j-0.72.1
openssl-doc-0.9.8j-0.72.1

– SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.72.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1

References:

https://www.suse.com/security/cve/CVE-2015-1788.html
https://www.suse.com/security/cve/CVE-2015-1789.html
https://www.suse.com/security/cve/CVE-2015-1790.html
https://www.suse.com/security/cve/CVE-2015-1791.html
https://www.suse.com/security/cve/CVE-2015-1792.html
https://www.suse.com/security/cve/CVE-2015-3216.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://bugzilla.suse.com/929678
https://bugzilla.suse.com/931698
https://bugzilla.suse.com/933911
https://bugzilla.suse.com/934487
https://bugzilla.suse.com/934489
https://bugzilla.suse.com/934491
https://bugzilla.suse.com/934493
https://download.suse.com/patch/finder/?keywords=75ca56dc2ed43571b870081da3f3b615

— To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1181-2
Rating: important
References: #929678 #931698 #934487 #934489 #934491
Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790
CVE-2015-4000
Affected Products:
SUSE Linux Enterprise Server 10 SP4 LTSS
______________________________________________________________________________

An update that solves four vulnerabilities and has one
errata is now available.

Description:

OpenSSL was updated to fix several security issues.

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
This will only get active if applications get rebuilt and actually
use this string. (bnc#931698)

Security Issues:

Package List:

– SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64):

openssl-0.9.8a-18.92.1
openssl-devel-0.9.8a-18.92.1
openssl-doc-0.9.8a-18.92.1

– SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64):

openssl-32bit-0.9.8a-18.92.1
openssl-devel-32bit-0.9.8a-18.92.1

References:

— To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1182-2
Rating: important
References: #879179 #929678 #931698 #933898 #933911 #934487
#934489 #934491 #934493
Cross-References: CVE-2015-1788 CVE-2015-1789 CVE-2015-1790
CVE-2015-1791 CVE-2015-1792 CVE-2015-3216
CVE-2015-4000
Affected Products:
SUSE Linux Enterprise Software Development Kit 11 SP3
SUSE Linux Enterprise Server 11 SP3 for VMware
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Desktop 11 SP3
______________________________________________________________________________

An update that solves 7 vulnerabilities and has two fixes
is now available.

Description:

OpenSSL 0.9.8k was updated to fix several security issues:

* CVE-2015-4000: The Logjam Attack (weakdh.org) has been addressed by
rejecting connections with DH parameters shorter than 1024 bits.
2048-bit DH parameters are now generated by default.
* CVE-2015-1788: Malformed ECParameters could cause an infinite loop.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
was fixed.
* CVE-2015-1792: A CMS verification infinite loop when using an
unknown hash function was fixed.
* CVE-2015-1791: Fixed a race condition in NewSessionTicket creation.
* CVE-2015-3216: Fixed a potential crash in ssleay_rand_bytes due to
locking regression.
* Fixed a timing side channel in RSA decryption. (bsc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
This will only get active if applications get rebuilt and actually
use this string. (bsc#931698)
* Added the ECC ciphersuites to the DEFAULT cipher class. (bsc#879179)

Security Issues:

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Software Development Kit 11 SP3:

zypper in -t patch sdksp3-libopenssl-devel=10781

– SUSE Linux Enterprise Server 11 SP3 for VMware:

zypper in -t patch slessp3-libopenssl-devel=10781

– SUSE Linux Enterprise Server 11 SP3:

zypper in -t patch slessp3-libopenssl-devel=10781

– SUSE Linux Enterprise Desktop 11 SP3:

zypper in -t patch sledsp3-libopenssl-devel=10781

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64):

libopenssl-devel-0.9.8j-0.72.1

– SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):

libopenssl0_9_8-0.9.8j-0.72.1
libopenssl0_9_8-hmac-0.9.8j-0.72.1
openssl-0.9.8j-0.72.1
openssl-doc-0.9.8j-0.72.1

– SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.72.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1

– SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):

libopenssl0_9_8-0.9.8j-0.72.1
libopenssl0_9_8-hmac-0.9.8j-0.72.1
openssl-0.9.8j-0.72.1
openssl-doc-0.9.8j-0.72.1

– SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.72.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.72.1

– SUSE Linux Enterprise Server 11 SP3 (ia64):

libopenssl0_9_8-x86-0.9.8j-0.72.1

– SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):

libopenssl0_9_8-0.9.8j-0.72.1
openssl-0.9.8j-0.72.1

– SUSE Linux Enterprise Desktop 11 SP3 (x86_64):

libopenssl0_9_8-32bit-0.9.8j-0.72.1

References:

— To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

SUSE Security Update: Security update for OpenSSL
______________________________________________________________________________

Announcement ID: SUSE-SU-2015:1183-2
Rating: important
References: #929678 #931698 #934489 #934491
Cross-References: CVE-2015-1789 CVE-2015-1790 CVE-2015-4000

Affected Products:
SUSE Linux Enterprise Server 10 SP4 LTSS
SUSE Linux Enterprise Desktop 11 SP3
SLES for SAP Applications
______________________________________________________________________________

An update that solves three vulnerabilities and has one
errata is now available.

Description:

OpenSSL was updated to fix several security issues.

* CVE-2015-4000: The Logjam Attack ( weakdh.org ) has been addressed
by rejecting connections with DH parameters shorter than 1024 bits.
We now also generate 2048-bit DH parameters by default.
* CVE-2015-1789: An out-of-bounds read in X509_cmp_time was fixed.
* CVE-2015-1790: A PKCS7 decoder crash with missing EnvelopedContent
was fixed.
* fixed a timing side channel in RSA decryption (bnc#929678)

Additional changes:

* In the default SSL cipher string EXPORT ciphers are now disabled.
This will only get active if applications get rebuilt and actually
use this string. (bnc#931698)

Security Issues:

Patch Instructions:

To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

– SUSE Linux Enterprise Desktop 11 SP3:

zypper in -t patch sledsp3-compat-openssl097g=10790

– SLES for SAP Applications:

zypper in -t patch slesappsp3-compat-openssl097g=10790

To bring your system up-to-date, use “zypper patch”.

Package List:

– SUSE Linux Enterprise Server 10 SP4 LTSS (i586 s390x x86_64):

compat-openssl097g-0.9.7g-13.31.1

– SUSE Linux Enterprise Server 10 SP4 LTSS (s390x x86_64):

compat-openssl097g-32bit-0.9.7g-13.31.1

– SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):

compat-openssl097g-0.9.7g-146.22.31.1

– SUSE Linux Enterprise Desktop 11 SP3 (x86_64):

compat-openssl097g-32bit-0.9.7g-146.22.31.1

– SLES for SAP Applications (x86_64):

compat-openssl097g-0.9.7g-146.22.31.1
compat-openssl097g-32bit-0.9.7g-146.22.31.1

References:

https://www.suse.com/security/cve/CVE-2015-1789.html
https://www.suse.com/security/cve/CVE-2015-1790.html
https://www.suse.com/security/cve/CVE-2015-4000.html
https://bugzilla.suse.com/929678
https://bugzilla.suse.com/931698
https://bugzilla.suse.com/934489
https://bugzilla.suse.com/934491
https://download.suse.com/patch/finder/?keywords=31613a0a584dc47c4e6779e1a0a09b87
https://download.suse.com/patch/finder/?keywords=9cebc5e391114f90b2cb9133b6763127

— To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org

Ranjivosti programskog paketa OpenSSL

Archives

More in Preporuke

Sigurnosni nedostatak programskog paketa MySQL