[ALSA-2023:3722] Moderate: openssl security and bug fix update
Release date:
OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650) * openssl: Denial of service by excessive resource usage in verifying X509 policy constraints (CVE-2023-0464) * openssl: Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465) * openssl: Certificate policy check not enabled (CVE-2023-0466) * openssl: Input buffer over-read in AES-XTS implementation on 64 bit ARM (CVE-2023-1255) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * In FIPS mode, openssl KDFs should only allow selected hash algorithms (BZ#2175860) * In FIPS mode, openssl should reject short KDF input or output keys or provide an indicator (BZ#2175864) * In FIPS mode, openssl should provide an indicator for AES-GCM to query whether the IV was generated internally or provided externally (BZ#2175868) * openssl FIPS mode self-test should zeroize `out` in `verify_integrity` in providers/fips/self_test.c (BZ#2175873) * In FIPS mode, openssl should not support RSA encryption or decryption without padding (outside of RSASVE) or provide an indicator (BZ#2178029) * In FIPS mode, openssl should reject EVP_PKEY_fromdata() for short DHX keys, or provide an indicator (BZ#2178030) * In FIPS mode, openssl should not use the legacy ECDSA_do_sign(), RSA_public_encrypt(), RSA_private_decrypt() functions for pairwise consistency tests (BZ#2178034) * In FIPS mode, openssl should enter error state when DH PCT fails (BZ#2178039) * In FIPS mode, openssl should always run the PBKDF2 lower bounds checks or provide an indicator when the pkcs5 parameter is set to 1 (BZ#2178137) * Support requiring EMS in TLS 1.2, default to it when in FIPS mode (BZ#2188046) * OpenSSL rsa_verify_recover doesn't use the same key checks as rsa_verify in FIPS mode (BZ#2188052) * AlmaLinux9.0 - sshd dumps core when ibmca engine is configured with default_algorithms = CIPHERS or ALL (openssl) (BZ#2211396)
Updated packages listed below:
Architecture Package Checksum
aarch64 openssl-devel-3.0.7-16.el9_2.aarch64.rpm 3714ad9da948d09da74e8c3c9e1ce32ba4f283715a1716dbc508d5409de9340a
aarch64 openssl-libs-3.0.7-16.el9_2.aarch64.rpm 737ea283d648d5e2bfba98588d4eabfc34065aca4038e029dd91618f0de0fbfc
aarch64 openssl-3.0.7-16.el9_2.aarch64.rpm a8a046ebfe80a42264d2c603e9892692c4441e58b1897af937460249572f5892
aarch64 openssl-perl-3.0.7-16.el9_2.aarch64.rpm e209f37da0fd968ae3b2cf13ee02aa549fad653c0670c81705d562b585fb0f62
i686 openssl-libs-3.0.7-16.el9_2.i686.rpm 6ca7be4faa5d4ad6a6addb7d5b96aa1e1aee03fc0ee0af32e48dcc8c2e08ecbb
i686 openssl-devel-3.0.7-16.el9_2.i686.rpm 9ce5fee153d14301d140f1e61801f09893700cadb49e76393f949949303220b6
ppc64le openssl-3.0.7-16.el9_2.ppc64le.rpm 30d73639186d86e1b26a29e15eb10e09ba8c8bb06c820dfa5f3c99295b06d440
ppc64le openssl-libs-3.0.7-16.el9_2.ppc64le.rpm 398b9605c9a415643a61c83ae27bb4e33cf17a58b603af14cdaedfa56624371e
ppc64le openssl-perl-3.0.7-16.el9_2.ppc64le.rpm 889852549cf85090f6dc249d4a129950cc31f6a882bd6ad87460867547753b12
ppc64le openssl-devel-3.0.7-16.el9_2.ppc64le.rpm d0aa0885f78dae71d2febb04cd66abf82d0ec712a4f421e74c1698e277c0b452
s390x openssl-perl-3.0.7-16.el9_2.s390x.rpm 1d2c647b0d5a65d437366038b0d4150064d2ef557e8277cff4bbf5036f6fd87d
s390x openssl-devel-3.0.7-16.el9_2.s390x.rpm 2af63f0cae9d2ae67e645eea02efe82a7efeb20d083f60b0754e3c29da668cd4
s390x openssl-libs-3.0.7-16.el9_2.s390x.rpm bd111e89ef716070f3a8981eae60b8319c82f5de8f3083f832408e179a34064e
s390x openssl-3.0.7-16.el9_2.s390x.rpm d232d2c7d7a0c5cd18d6ee681d255b6e8a5b91419d26b7d7707d57c7c933f0dc
x86_64 openssl-devel-3.0.7-16.el9_2.x86_64.rpm 9b83522d3b0b5f888d41ea99809726ec2f587a96006a8b7fff6313b630f8ecfc
x86_64 openssl-libs-3.0.7-16.el9_2.x86_64.rpm a31dd9fab03dae495bd935c233e1e9e62132459fdae3805aba98ccbd4959bb7e
x86_64 openssl-perl-3.0.7-16.el9_2.x86_64.rpm a687497485466fd0de12822f74b05b8ff8e2021a8edb8e6d215448d5a2142243
x86_64 openssl-3.0.7-16.el9_2.x86_64.rpm d6f1c2c078ddd1f09ee4a0691e47d57041a3d2cda3b49a820a399e96cb80ab22
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.