Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:1058-1

Опубликовано: 29 апр. 2020
Источник: suse-cvrf

Описание

Security update for openssl-1_1

This update for openssl-1_1 fixes the following issues:

  • CVE-2020-1967: Fixed a denial of service via NULL pointer dereference in SSL_check_chain (bsc#1169407).

Список пакетов

Image SLES12-SP5-Azure-BYOS
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-Azure-Basic-On-Demand
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-Azure-HPC-BYOS
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-Azure-HPC-On-Demand
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-Azure-SAP-BYOS
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-Azure-SAP-On-Demand
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-Azure-Standard-On-Demand
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-EC2-BYOS
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-EC2-ECS-On-Demand
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-EC2-On-Demand
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-EC2-SAP-BYOS
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-EC2-SAP-On-Demand
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-GCE-BYOS
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-GCE-On-Demand
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-GCE-SAP-BYOS
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-GCE-SAP-On-Demand
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
libopenssl1_1-1.1.1d-2.23.1
SUSE Linux Enterprise Server 12 SP4
libopenssl1_1-1.1.1d-2.23.1
libopenssl1_1-32bit-1.1.1d-2.23.1
openssl-1_1-1.1.1d-2.23.1
SUSE Linux Enterprise Server 12 SP5
libopenssl1_1-1.1.1d-2.23.1
libopenssl1_1-32bit-1.1.1d-2.23.1
openssl-1_1-1.1.1d-2.23.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4
libopenssl1_1-1.1.1d-2.23.1
libopenssl1_1-32bit-1.1.1d-2.23.1
openssl-1_1-1.1.1d-2.23.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
libopenssl1_1-1.1.1d-2.23.1
libopenssl1_1-32bit-1.1.1d-2.23.1
openssl-1_1-1.1.1d-2.23.1
SUSE Linux Enterprise Software Development Kit 12 SP4
libopenssl-1_1-devel-1.1.1d-2.23.1
libopenssl-1_1-devel-32bit-1.1.1d-2.23.1
SUSE Linux Enterprise Software Development Kit 12 SP5
libopenssl-1_1-devel-1.1.1d-2.23.1
libopenssl-1_1-devel-32bit-1.1.1d-2.23.1

Ссылки

Описание

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-Azure-Basic-On-Demand:libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-Azure-HPC-BYOS:libopenssl1_1-1.1.1d-2.23.1
Image SLES12-SP5-Azure-HPC-On-Demand:libopenssl1_1-1.1.1d-2.23.1
Ссылки
Уязвимость SUSE-SU-2020:1058-1