SUSE-SU-2024:0813-1: Security update for openssl-1_1
This update for openssl-11 fixes the following issues: CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file (bsc#1219243).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_1-debuginfo-1.1.1d-2.104.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_1-debugsource-1.1.1d-2.104.1 - Upgrade
Upgrade
suse/libopensslto a version that resolves this vulnerability.Fixed in 1_1-devel-1.1.1d-2.104.1 - Upgrade
Upgrade
suse/libopensslto a version that resolves this vulnerability.Fixed in 1_1-devel-32bit-1.1.1d-2.104.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_1-1.1.1d-2.104.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SDK-12-SP5-2024-813=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-2024-813=1
Event History
Frequently Asked Questions
What attacker interaction is required to trigger the denial of service?
An attacker needs to cause the affected OpenSSL 1.1 installation to process a maliciously formatted PKCS#12 file. The provided advisory does not specify a network-facing attack path or other delivery mechanism.
Which systems are identified as affected by this update?
The update applies to openssl and libopenssl on SUSE Linux Enterprise Server 12 SP5, SUSE Linux Enterprise High Performance Computing 12 SP5, and SUSE Linux Enterprise Software Development Kit 12 SP5. Listed architectures include aarch64, ppc64le, s390x, and x86_64, with availability varying by product.
What is the stated impact?
The stated impact is denial of service while processing a maliciously formatted PKCS#12 file. No confidentiality or integrity impact is described in the provided advisory.