CWE
119 416 415
Advisory Published
Updated

RHSA-2023:1199: Important: openssl security and bug fix update

First published: Tue Mar 14 2023(Updated: )

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.<br>Security Fix(es):<br><li> openssl: X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)</li> <li> openssl: read buffer overflow in X.509 certificate verification (CVE-2022-4203)</li> <li> openssl: timing attack in RSA Decryption implementation (CVE-2022-4304)</li> <li> openssl: double free after calling PEM_read_bio_ex (CVE-2022-4450)</li> <li> openssl: use-after-free following BIO_new_NDEF (CVE-2023-0215)</li> <li> openssl: invalid pointer dereference in d2i_PKCS7 functions (CVE-2023-0216)</li> <li> openssl: NULL dereference validating DSA public key (CVE-2023-0217)</li> <li> openssl: NULL dereference during PKCS7 data verification (CVE-2023-0401)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> HMAC generation should reject key lengths &lt; 112 bits or provide an indicator in FIPS mode (BZ#2144001)</li> <li> In FIPS mode, openssl should set a minimum length for passwords in PBKDF2 (BZ#2144004)</li> <li> stunnel consumes high amount of memory when pestered with TCP connections without a TLS handshake (BZ#2144009)</li> <li> In FIPS mode, openssl should reject SHAKE as digest for RSA-OAEP or provide an indicator (BZ#2144011)</li> <li> In FIPS mode, openssl should reject RSASSA-PSS salt lengths larger than the output size of the hash function used, or provide an indicator (BZ#2144013)</li> <li> In FIPS mode, openssl should reject RSA signatures with X9.31 padding, or provide an indicator (BZ#2144016)</li> <li> In FIPS mode, openssl should reject SHA-224, SHA-384, SHA-512-224, and SHA-512-256 as hashes for hash-based DRBGs, or provide an indicator after 2023-05-16 (BZ#2144018)</li> <li> In FIPS mode, openssl should reject KDF input and output key lengths &lt; 112 bits or provide an indicator (BZ#2144020)</li> <li> In FIPS mode, openssl should reject RSA keys &lt; 2048 bits when using EVP_PKEY_decapsulate, or provide an indicator (BZ#2145171)</li> <li> OpenSSL FIPS checksum code needs update (BZ#2158413)</li>

Affected SoftwareAffected VersionHow to fix
redhat/openssl<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-debuginfo<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-debuginfo<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-debugsource<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-debugsource<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-devel<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-devel<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-libs<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-libs<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-libs-debuginfo<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-libs-debuginfo<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-perl<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-perl<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-debuginfo<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-debugsource<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-devel<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-libs<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-libs-debuginfo<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl-perl<3.0.1-46.el9_0
3.0.1-46.el9_0
redhat/openssl<3.0.1-46.el9_0.aa
3.0.1-46.el9_0.aa
redhat/openssl-debuginfo<3.0.1-46.el9_0.aa
3.0.1-46.el9_0.aa
redhat/openssl-debugsource<3.0.1-46.el9_0.aa
3.0.1-46.el9_0.aa
redhat/openssl-devel<3.0.1-46.el9_0.aa
3.0.1-46.el9_0.aa
redhat/openssl-libs<3.0.1-46.el9_0.aa
3.0.1-46.el9_0.aa
redhat/openssl-libs-debuginfo<3.0.1-46.el9_0.aa
3.0.1-46.el9_0.aa
redhat/openssl-perl<3.0.1-46.el9_0.aa
3.0.1-46.el9_0.aa

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203