SUSE-SU-2023:2327-1: Security update for openssl-1_1
This update for openssl-11 fixes the following issues: CVE-2023-2650: Fixed possible denial of service translating ASN.1 object identifiers (bsc#1211430).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_1-debugsource-1.1.0i-150100.14.51.1 - Upgrade
Upgrade
suse/libopensslto a version that resolves this vulnerability.Fixed in 1_1-devel-1.1.0i-150100.14.51.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_1-debuginfo-1.1.0i-150100.14.51.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_1-1.1.0i-150100.14.51.1 - Upgrade
Upgrade
suse/libopensslto a version that resolves this vulnerability.Fixed in 1_1-devel-32bit-1.1.0i-150100.14.51.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-2327=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-2327=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-2327=1
Event History
Frequently Asked Questions
Which systems are covered by this update?
The update applies to listed SUSE Linux Enterprise 15 SP1 LTSS, High Performance Computing 15 SP1 LTSS, and Server for SAP Applications 15 SP1 systems using the affected openssl or libopenssl packages. Listed architectures include aarch64, ppc64le, s390x, and x86_64, depending on the product.
What is the impact of successful exploitation?
The issue can cause a denial of service while translating ASN.1 object identifiers.