Lucene search

K
osvGoogleOSV:SUSE-SU-2024:3106-1
HistorySep 03, 2024 - 3:00 p.m.

Security update for openssl-3

2024-09-0315:00:41
Google
osv.dev

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

This update for openssl-3 fixes the following issues:

  • CVE-2024-6119: Fixed denial of service in X.509 name checks (bsc#1229465)

Other fixes:

  • FIPS: Deny SHA-1 signature verification in FIPS provider (bsc#1221365).
  • FIPS: RSA keygen PCT requirements.
  • FIPS: Check that the fips provider is available before setting
    it as the default provider in FIPS mode (bsc#1220523).
  • FIPS: Port openssl to use jitterentropy (bsc#1220523).
  • FIPS: Block non-Approved Elliptic Curves (bsc#1221786).
  • FIPS: Service Level Indicator (bsc#1221365).
  • FIPS: Output the FIPS-validation name and module version which uniquely
    identify the FIPS validated module (bsc#1221751).
  • FIPS: Add required selftests: (bsc#1221760).
  • FIPS: DH: Disable FIPS 186-4 Domain Parameters (bsc#1221821).
  • FIPS: Recommendation for Password-Based Key Derivation (bsc#1221827).
  • FIPS: Zero initialization required (bsc#1221752).
  • FIPS: Reseed DRBG (bsc#1220690, bsc#1220693, bsc#1220696).
  • FIPS: NIST SP 800-56Brev2 (bsc#1221824).
  • FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 (bsc#1221787).
  • FIPS: Port openssl to use jitterentropy (bsc#1220523).
  • FIPS: NIST SP 800-56Arev3 (bsc#1221822).
  • FIPS: Error state has to be enforced (bsc#1221753).

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N