SUSE-SU-2024:0814-1: Security update for openssl-1_0_0
This update for openssl-100 fixes the following issues: CVE-2024-0727: Denial of service when processing a maliciously formatted PKCS12 file (bsc#1219243).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_0_0-debuginfo-1.0.2p-3.90.1 - Upgrade
Upgrade
suse/libopensslto a version that resolves this vulnerability.Fixed in 1_0_0-devel-1.0.2p-3.90.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_0_0-debugsource-1.0.2p-3.90.1 - Upgrade
Upgrade
suse/libopensslto a version that resolves this vulnerability.Fixed in 1_0_0-devel-32bit-1.0.2p-3.90.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_0_0-1.0.2p-3.90.1 - Upgrade
Upgrade
suse/opensslto a version that resolves this vulnerability.Fixed in 1_0_0-doc-1.0.2p-3.90.1 - Upgrade
Upgrade
openssl-1_0_0to a version that resolves this vulnerability.Patch SUSE-SLE-SDK-12-SP5-2024-814=1 - Upgrade
Upgrade
openssl-1_0_0to a version that resolves this vulnerability.Patch SUSE-SLE-SERVER-12-SP5-2024-814=1
Event History
Frequently Asked Questions
Which systems are covered by this update?
The update applies to SUSE Linux Enterprise Server 12 SP5, SUSE Linux Enterprise High Performance Computing 12 SP5, and SUSE Linux Enterprise Software Development Kit 12 SP5 systems that use the affected openssl or libopenssl packages. Listed architectures include aarch64, ppc64le, s390x, and x86_64, with availability varying by product.
What attacker-controlled input is needed to trigger the issue?
The denial of service is triggered when the affected software processes a maliciously formatted PKCS#12 file. The provided information does not state whether this can be reached remotely or requires a user or application to import or process the file.
How can I identify potentially affected systems?
Identify systems running the listed SUSE 12 SP5 products and check whether openssl or libopenssl is installed. The advisory does not provide package version details, so it cannot be used alone to distinguish patched from unpatched installations.