Security update for openssl SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2018:3903-1 Final 1 1 2018-11-24T11:28:02Z current 2018-11-24T11:28:02Z 2018-11-24T11:28:02Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl This update for openssl fixes the following issues: Security issues fixed: - CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652). - CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534). - Add missing timing side channel patch for DSA signature generation (bsc#1113742). Non-security issues fixed: - Fixed infinite loop in DSA generation with incorrect parameters (bsc#1112209). This update was imported from the SUSE:SLE-12-SP2:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2018-11/msg00046.html E-Mail link for openSUSE-SU-2018:3903-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.3 libopenssl-devel-1.0.2j-32.1 libopenssl-devel-32bit-1.0.2j-32.1 libopenssl1_0_0-1.0.2j-32.1 libopenssl1_0_0-32bit-1.0.2j-32.1 libopenssl1_0_0-hmac-1.0.2j-32.1 libopenssl1_0_0-hmac-32bit-1.0.2j-32.1 openssl-1.0.2j-32.1 openssl-cavs-1.0.2j-32.1 openssl-doc-1.0.2j-32.1 libopenssl-devel-1.0.2j-32.1 as a component of openSUSE Leap 42.3 libopenssl-devel-32bit-1.0.2j-32.1 as a component of openSUSE Leap 42.3 libopenssl1_0_0-1.0.2j-32.1 as a component of openSUSE Leap 42.3 libopenssl1_0_0-32bit-1.0.2j-32.1 as a component of openSUSE Leap 42.3 libopenssl1_0_0-hmac-1.0.2j-32.1 as a component of openSUSE Leap 42.3 libopenssl1_0_0-hmac-32bit-1.0.2j-32.1 as a component of openSUSE Leap 42.3 openssl-1.0.2j-32.1 as a component of openSUSE Leap 42.3 openssl-cavs-1.0.2j-32.1 as a component of openSUSE Leap 42.3 openssl-doc-1.0.2j-32.1 as a component of openSUSE Leap 42.3 The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.0.2q (Affected 1.0.2-1.0.2p). CVE-2018-0734 openSUSE Leap 42.3:libopenssl-devel-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl-devel-32bit-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl1_0_0-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl1_0_0-32bit-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl1_0_0-hmac-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl1_0_0-hmac-32bit-1.0.2j-32.1 openSUSE Leap 42.3:openssl-1.0.2j-32.1 openSUSE Leap 42.3:openssl-cavs-1.0.2j-32.1 openSUSE Leap 42.3:openssl-doc-1.0.2j-32.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 5.9 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-11/msg00046.html https://www.suse.com/security/cve/CVE-2018-0734.html CVE-2018-0734 https://bugzilla.suse.com/1113534 SUSE Bug 1113534 https://bugzilla.suse.com/1113652 SUSE Bug 1113652 https://bugzilla.suse.com/1113742 SUSE Bug 1113742 https://bugzilla.suse.com/1122198 SUSE Bug 1122198 https://bugzilla.suse.com/1122212 SUSE Bug 1122212 https://bugzilla.suse.com/1126909 SUSE Bug 1126909 Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'. CVE-2018-5407 openSUSE Leap 42.3:libopenssl-devel-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl-devel-32bit-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl1_0_0-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl1_0_0-32bit-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl1_0_0-hmac-1.0.2j-32.1 openSUSE Leap 42.3:libopenssl1_0_0-hmac-32bit-1.0.2j-32.1 openSUSE Leap 42.3:openssl-1.0.2j-32.1 openSUSE Leap 42.3:openssl-cavs-1.0.2j-32.1 openSUSE Leap 42.3:openssl-doc-1.0.2j-32.1 moderate 1.9 AV:L/AC:M/Au:N/C:P/I:N/A:N 4.8 CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-security-announce/2018-11/msg00046.html https://www.suse.com/security/cve/CVE-2018-5407.html CVE-2018-5407 https://bugzilla.suse.com/1113534 SUSE Bug 1113534 https://bugzilla.suse.com/1116195 SUSE Bug 1116195 https://bugzilla.suse.com/1126909 SUSE Bug 1126909