Lucene search

K
slackwareSlackware Linux ProjectSSA-2023-213-01
HistoryAug 02, 2023 - 5:08 p.m.

[slackware-security] openssl

2023-08-0217:08:29
Slackware Linux Project
www.slackware.com
26
openssl
security fix
slackware 15.0
-current
upgrade
cve-2023-3817
cve-2023-3446
dh parameter
modulus

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

0.003 Low

EPSS

Percentile

65.6%

New openssl packages are available for Slackware 15.0 and -current to
fix security issues.

Here are the details from the Slackware 15.0 ChangeLog:

patches/packages/openssl-1.1.1v-i586-1_slack15.0.txz: Upgraded.
This update fixes bugs and security issues:
Fix excessive time spent checking DH q parameter value.
Fix DH_check() excessive time with over sized modulus.
For more information, see:
https://www.openssl.org/news/secadv/20230731.txt
https://www.openssl.org/news/secadv/20230719.txt
https://vulners.com/cve/CVE-2023-3817
https://vulners.com/cve/CVE-2023-3446
(* Security fix *)
patches/packages/openssl-solibs-1.1.1v-i586-1_slack15.0.txz: Upgraded.

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/openssl-1.1.1v-i586-1_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/openssl-solibs-1.1.1v-i586-1_slack15.0.txz

Updated packages for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/openssl-1.1.1v-x86_64-1_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/openssl-solibs-1.1.1v-x86_64-1_slack15.0.txz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/openssl-solibs-3.1.2-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/openssl-3.1.2-i586-1.txz

Updated packages for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/a/openssl-solibs-3.1.2-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/openssl-3.1.2-x86_64-1.txz

MD5 signatures:

Slackware 15.0 packages:
f8063e6a32e6d09b3589b95542978a53 openssl-1.1.1v-i586-1_slack15.0.txz
7cf83588ad6b1821015e2c886bd34f23 openssl-solibs-1.1.1v-i586-1_slack15.0.txz

Slackware x86_64 15.0 packages:
b7ecaea2473c40a8d2ccd9a8c7a4bc51 openssl-1.1.1v-x86_64-1_slack15.0.txz
36dd4b29f2dca9c776ec13c578c3d6e3 openssl-solibs-1.1.1v-x86_64-1_slack15.0.txz

Slackware -current packages:
fd660e4ef6911eacf08ab8cd085b7a3d a/openssl-solibs-3.1.2-i586-1.txz
1e91105d570621c561f218ede115c0fb n/openssl-3.1.2-i586-1.txz

Slackware x86_64 -current packages:
23057ef0aa1b465af1945e15607678f6 a/openssl-solibs-3.1.2-x86_64-1.txz
b9cc7784987a45c22337e5f0a52f8c55 n/openssl-3.1.2-x86_64-1.txz

Installation instructions:

Upgrade the packages as root:
> upgradepkg openssl-1.1.1v-i586-1_slack15.0.txz openssl-solibs-1.1.1v-i586-1_slack15.0.txz

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

0.003 Low

EPSS

Percentile

65.6%