SUSE-SU-2024:0157-1: Security update for libcryptopp
This update for libcryptopp fixes the following issues: CVE-2023-50981: Fixed a potential denial of service issue via crafted DER public key data (bsc#1218222).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libcryptopp-debugsourceto a version that resolves this vulnerability.Fixed in 8.6.0-150400.3.6.1 - Upgrade
Upgrade
suse/libcryptopp-develto a version that resolves this vulnerability.Fixed in 8.6.0-150400.3.6.1 - Upgrade
Upgrade
Basesystem Module 15-SP5to a version that resolves this vulnerability.Patch SUSE-SLE-Module-Basesystem-15-SP5-2024-157=1 - Upgrade
Upgrade
SUSE Linux Enterprise Real Time 15 SP4to a version that resolves this vulnerability.Patch SUSE-SLE-Product-RT-15-SP4-2024-157=1 - Upgrade
Upgrade
openSUSE Leap 15.4to a version that resolves this vulnerability.Patch SUSE-2024-157=1 - Upgrade
Upgrade
openSUSE Leap 15.5to a version that resolves this vulnerability.Patch openSUSE-SLE-15.5-2024-157=1
Event History
Frequently Asked Questions
What input must an attacker control to trigger this issue?
The issue is triggered by crafted DER public-key data. Systems are exposed where libcryptopp processes DER-encoded public keys from an untrusted source.
What is the practical impact of successful exploitation?
The stated impact is a potential denial of service. The provided advisory does not describe data disclosure, privilege escalation, or code execution.
Which SUSE platforms are covered by this update?
The update covers openSUSE Leap 15.4 and 15.5, SUSE Basesystem Module 15-SP5, and SUSE Linux Enterprise Real Time 15 SP4, on the architectures listed in the advisory.