Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2017:1211-1

Опубликовано: 08 мая 2017
Источник: suse-cvrf

Описание

Security update for libressl

This update for libressl to version 2.5.1 fixes the following issues:

These security issues were fixed:

  • CVE-2016-0702: Prevent side channel attack on modular exponentiation (boo#968050).
  • CVE-2016-7056: Avoid a side-channel cache-timing attack that can leak the ECDSA private keys when signing (boo#1019334).

These non-security issues were fixed:

  • Detect zero-length encrypted session data early
  • Curve25519 Key Exchange support.
  • Support for alternate chains for certificate verification.
  • Added EVP interface for MD5+SHA1 hashes
  • Fixed DTLS client failures when the server sends a certificate request.
  • Corrected handling of padding when upgrading an SSLv2 challenge into an SSLv3/TLS connection.
  • Allowed protocols and ciphers to be set on a TLS config object in libtls.

For additional changes please refer to the changelog.

Список пакетов

openSUSE Leap 42.2
libcrypto41-2.5.3-5.3.1
libcrypto41-32bit-2.5.3-5.3.1
libressl-2.5.3-5.3.1
libressl-devel-2.5.3-5.3.1
libressl-devel-32bit-2.5.3-5.3.1
libressl-devel-doc-2.5.3-5.3.1
libssl43-2.5.3-5.3.1
libssl43-32bit-2.5.3-5.3.1
libtls15-2.5.3-5.3.1
libtls15-32bit-2.5.3-5.3.1

Ссылки

Описание

The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it easier for local users to discover RSA keys by running a crafted application on the same Intel Sandy Bridge CPU core as a victim and leveraging cache-bank conflicts, aka a "CacheBleed" attack.

Затронутые продукты
openSUSE Leap 42.2:libcrypto41-2.5.3-5.3.1
openSUSE Leap 42.2:libcrypto41-32bit-2.5.3-5.3.1
openSUSE Leap 42.2:libressl-2.5.3-5.3.1
openSUSE Leap 42.2:libressl-devel-2.5.3-5.3.1
Ссылки

Описание

A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 private keys.

Затронутые продукты
openSUSE Leap 42.2:libcrypto41-2.5.3-5.3.1
openSUSE Leap 42.2:libcrypto41-32bit-2.5.3-5.3.1
openSUSE Leap 42.2:libressl-2.5.3-5.3.1
openSUSE Leap 42.2:libressl-devel-2.5.3-5.3.1
Ссылки