Red Hat Security Advisory

RHSA-2023:7877

openssl security update

Released 2023-12-19 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1k-12.el8_9, openssl-devel-1:1.1.1k-12.el8_9, openssl-libs-1:1.1.1k-12.el8_9 +1

Fixes 4 records

TI-2024-02236 CVE-2024-2408

PHP is vulnerable to the Marvin Attack

MEDIUM 60

The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01158 Published 2024-06-09 Partial fix · 8.1.29, 8.2.20 +1 CWE-203

TI-2023-03220 CVE-2023-3446 · GHSA-3p3x-vg38-6g9q

Excessive time spent checking DH keys and parameters

LOW 39

Issue summary: Checking excessively long DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06531 Published 2023-07-19 Partial fix · 3.1.2, 3.0.10 +2 CWE-606

TI-2023-05221 CVE-2023-5678 · GHSA-2cj7-mg3x-9mhq

Excessive time spent in DH check / generation with large Q parameter value

LOW 38

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05091 Published 2023-11-06 Partial fix · 1.0.2zj, 1.1.1x +2 CWE-606

TI-2023-03567 CVE-2023-3817 · GHSA-c945-cqj5-wfv6

Excessive time spent checking DH q parameter value

LOW 36

Issue summary: Checking excessively long DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03047 Published 2023-07-31 Partial fix · 3.1.2, 3.0.10 +2 CWE-606