Lucene search

K
slackwareSlackware Linux ProjectSSA-2019-254-03
HistorySep 12, 2019 - 5:20 a.m.

[slackware-security] openssl

2019-09-1205:20:57
Slackware Linux Project
www.slackware.com
28

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

0.015 Low

EPSS

Percentile

87.1%

New openssl packages are available for Slackware 14.2 and -current to
fix security issues.

Here are the details from the Slackware 14.2 ChangeLog:

patches/packages/openssl-1.0.2t-i586-1_slack14.2.txz: Upgraded.
This update fixes low severity security issues:
Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
Compute ECC cofactors if not provided during EC_GROUP construction
For more information, see:
https://vulners.com/cve/CVE-2019-1563
https://vulners.com/cve/CVE-2019-1547
(* Security fix *)
patches/packages/openssl-solibs-1.0.2t-i586-1_slack14.2.txz: Upgraded.

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-1.0.2t-i586-1_slack14.2.txz
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/openssl-solibs-1.0.2t-i586-1_slack14.2.txz

Updated packages for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-1.0.2t-x86_64-1_slack14.2.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/openssl-solibs-1.0.2t-x86_64-1_slack14.2.txz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-1.1.1d-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-1.1.1d-i586-1.txz

Updated packages for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/openssl-solibs-1.1.1d-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssl-1.1.1d-x86_64-1.txz

MD5 signatures:

Slackware 14.2 packages:
903720b73725547f29d4d9b73e033501 openssl-1.0.2t-i586-1_slack14.2.txz
eba348070c289ec02a9892f3a82d7cfc openssl-solibs-1.0.2t-i586-1_slack14.2.txz

Slackware x86_64 14.2 packages:
e869ff17a8644c1f415ef603bfee43ad openssl-1.0.2t-x86_64-1_slack14.2.txz
fd8ef08d4df6cf279a14d504b2f96164 openssl-solibs-1.0.2t-x86_64-1_slack14.2.txz

Slackware -current packages:
412545282b13cb9f641cec5771b7c4e7 a/openssl-solibs-1.1.1d-i586-1.txz
87963935bfd9fba4daab83682f0a2329 n/openssl-1.1.1d-i586-1.txz

Slackware x86_64 -current packages:
d0617da050eea3ed90f272fd110636f7 a/openssl-solibs-1.1.1d-x86_64-1.txz
cacd12f8db7e9ed50008dd5e7dbd2073 n/openssl-1.1.1d-x86_64-1.txz

Installation instructions:

Upgrade the packages as root:
> upgradepkg openssl-1.0.2t-i586-1_slack14.2.txz openssl-solibs-1.0.2t-i586-1_slack14.2.txz

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

0.015 Low

EPSS

Percentile

87.1%