SUSE-SU-2023:3179-1

UNKNOWN

Security update for openssl-1_1

Published Aug 3, 2023

Modified 2 years ago

Fix available

Details

This update for openssl-1_1 fixes the following issues:

CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption. The previous fix for this timing side channel turned out to cause a severe 2-3x performance regression in the typical use case (bsc#1207534).
CVE-2023-3446: Fixed DH_check() excessive time with over sized modulus (bsc#1213487).
Update further expiring certificates that affect tests [bsc#1201627]

Affected Packages

libopenssl-1_1-devel

SUSE Enterprise Storage 7SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSSUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSS

Fixed in:

1.1.1d-150200.11.72.1

libopenssl1_1

Fixed in:

1.1.1d-150200.11.72.1

libopenssl1_1-32bit

Fixed in:

1.1.1d-150200.11.72.1

libopenssl1_1-hmac

Fixed in:

1.1.1d-150200.11.72.1

libopenssl1_1-hmac-32bit

Fixed in:

1.1.1d-150200.11.72.1

openssl-1_1

Fixed in:

1.1.1d-150200.11.72.1

libopenssl-1_1-devel-32bit

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Real Time 15 SP3SUSE Linux Enterprise Server 15 SP3-LTSS

Fixed in:

1.1.1d-150200.11.72.1

openssl-1_1-doc

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Server 15 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP3

Fixed in:

1.1.1d-150200.11.72.1

References

REPORT

https://bugzilla.suse.com/1201627

REPORT

https://bugzilla.suse.com/1207534

REPORT

https://bugzilla.suse.com/1213487

WEB

https://www.suse.com/security/cve/CVE-2022-4304

WEB