Red Hat Security Advisory

RHSA-2024:2447

openssl and openssl-fips-provider security update

Released 2024-04-30 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.7-27.el9, openssl-perl-1:3.0.7-27.el9
Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.7-27.el9, openssl-libs-1:3.0.7-27.el9

Fixes 7 records

TI-2023-03220 CVE-2023-3446 · GHSA-3p3x-vg38-6g9q

Excessive time spent checking DH keys and parameters

LOW 39

Issue summary: Checking excessively long DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06531 Published 2023-07-19 Partial fix · 3.1.2, 3.0.10 +2 CWE-606

TI-2023-05221 CVE-2023-5678 · GHSA-2cj7-mg3x-9mhq

Excessive time spent in DH check / generation with large Q parameter value

LOW 38

Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.05091 Published 2023-11-06 Partial fix · 1.0.2zj, 1.1.1x +2 CWE-606

TI-2023-03567 CVE-2023-3817 · GHSA-c945-cqj5-wfv6

Excessive time spent checking DH q parameter value

LOW 36

Issue summary: Checking excessively long DH keys or parameters may be very slow.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.03047 Published 2023-07-31 Partial fix · 3.1.2, 3.0.10 +2 CWE-606

TI-2023-05634 CVE-2023-6129 · GHSA-rj8q-prqp-jwfg

POLY1305 MAC implementation corrupts vector registers on PowerPC

LOW 33

Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instruct…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.02323 Published 2024-01-09 Partial fix · 3.2.1, 3.1.5 +1 CWE-440

TI-2024-00667 CVE-2024-0727 · GHSA-9v9h-cgj8-h64p

PKCS12 Decoding crashes

LOW 31

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sourc…

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.03187 Published 2024-01-26 Partial fix · 3.2.1, 3.1.5 +4 CWE-476

TI-2023-05728 CVE-2023-6237 · GHSA-hvc4-mjv4-5mw6

Excessive time spent checking invalid RSA public keys

LOW 31

Issue summary: Checking excessively long invalid RSA public keys may take a long time.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02303 Published 2024-04-25 Fixed in 3.0.13, 3.1.5 +1 CWE-606

TI-2023-02787 CVE-2023-2975 · GHSA-hpqg-7fjp-436p

AES-SIV implementation ignores empty associated data entries

LOW 31

Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00617 Published 2023-07-14 Partial fix · 3.1.2, 3.0.10 CWE-354