Lucene search

K
oraclelinuxOracleLinuxELSA-2024-2447
HistoryMay 03, 2024 - 12:00 a.m.

openssl and openssl-fips-provider security update

2024-05-0300:00:00
linux.oracle.com
20
openssl
fips
security
update
unix

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

0.004 Low

EPSS

Percentile

72.9%

openssl
[1:3.0.7-27.0.3]

  • Enable openssl-fips-provider dependency [Orabug: 36504822]
    [1:3.0.7-27.0.2]
  • Temporary disable openssl-fips-provider dependency [Orabug: 36504822]
    [1:3.0.7-27.0.1]
  • Replace upstream references [Orabug: 34340177]
    [1:3.0.7-27]
  • Use certified FIPS module instead of freshly built one in Red Hat distribution
    Related: RHEL-23474
    [1:3.0.7-26]
  • Avoid implicit function declaration when building openssl
    Related: RHEL-1780
  • In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails
    Resolves: RHEL-17104
  • Add a directory for OpenSSL providers configuration
    Resolves: RHEL-17193
  • Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context
    Resolves: RHEL-19515
  • POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)
    Resolves: RHEL-21151
  • Excessive time spent checking invalid RSA public keys (CVE-2023-6237)
    Resolves: RHEL-21654
  • SSL ECDHE Kex fails when pkcs11 engine is set in config file
    Resolves: RHEL-20249
  • Denial of service via null dereference in PKCS#12
    Resolves: RHEL-22486
  • Use certified FIPS module instead of freshly built one in Red Hat distribution
    Resolves: RHEL-23474
    openssl-fips-provider
    [3.0.7-2.0.1]
  • Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files [Orabug: 36504822]
  • Replace upstream references [Orabug: 34340177]
    [3.0.7-2]
  • Denote conflict with old versions of openssl-libs package
    Related: RHEL-23474
    [3.0.7-1]
    Initial packaging

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

0.004 Low

EPSS

Percentile

72.9%