SUSE-SU-2024:0518-1: Security update for openssl-3
This update for openssl-3 fixes the following issues: CVE-2023-6129: Fixed vector register clobbering on PowerPC. (bsc#1218690) CVE-2023-6237: Fixed excessive time spent checking invalid RSA public keys. (bsc#1218810) CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file (bsc#1219243).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/libopenssl3-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/libopensslto a version that resolves this vulnerability.Fixed in 3-devel-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 3-debugsource-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 3-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 3-debuginfo-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/libopenssl3to a version that resolves this vulnerability.Fixed in 3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/libopenssl3to a version that resolves this vulnerability.Fixed in 32bit-debuginfo-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/libopenssl3to a version that resolves this vulnerability.Fixed in 32bit-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/libopensslto a version that resolves this vulnerability.Fixed in 3-devel-32bit-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 3-doc-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/libopenssl3to a version that resolves this vulnerability.Fixed in 64bit-debuginfo-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/libopenssl3to a version that resolves this vulnerability.Fixed in 64bit-3.0.8-150400.4.49.1 - Upgrade
Upgrade
suse/libopensslto a version that resolves this vulnerability.Fixed in 3-devel-64bit-3.0.8-150400.4.49.1 - Upgrade
Upgrade
openssl-3to a version that resolves this vulnerability.Patch SUSE-2024-518
Event History
Frequently Asked Questions
Which systems are covered by this update?
The update applies to listed openssl and libopenssl packages on SUSE Linux Enterprise Desktop 15 SP4 LTSS, SUSE Linux Enterprise Server 15 SP4 LTSS, SUSE Linux Enterprise Server for SAP Applications 15 SP4, and SUSE Manager Proxy 4.3. Supported architectures vary by product and include x86_64, aarch64, ppc64le, and s390x.
What attacker-controlled input can trigger the denial of service?
The denial-of-service issue is triggered when OpenSSL processes a maliciously formatted PKCS12 file. Systems that import, inspect, or otherwise process PKCS12 files from untrusted sources are exposed to this condition.
What other attack scenarios are addressed?
The update fixes excessive processing time when checking invalid RSA public keys, which may allow resource exhaustion where an attacker can supply malformed RSA public keys. It also fixes vector register clobbering on PowerPC systems.