Security update for libgcrypt SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:1792-1 Final 1 1 2019-07-23T11:22:20Z current 2019-07-23T11:22:20Z 2019-07-23T11:22:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for libgcrypt This update for libgcrypt fixes the following issues: Security issues fixed: - CVE-2019-12904: The C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) (bsc#1138939) Other bugfixes: - Don't run full FIPS self-tests from constructor (bsc#1097073) - Skip all the self-tests except for binary integrity when called from the constructor (bsc#1097073) - Enforce the minimal RSA keygen size in fips mode (bsc#1125740) - avoid executing some tests twice. - Fixed a race condition in initialization. - Fixed env-script-interpreter in cavs_driver.pl - Fixed redundant fips tests in some situations causing failure to boot in fips mode. (bsc#1097073) This helps during booting of the system in FIPS mode with insufficient entropy. This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-1792 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html E-Mail link for openSUSE-SU-2019:1792-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1097073 SUSE Bug 1097073 https://bugzilla.suse.com/1125740 SUSE Bug 1125740 https://bugzilla.suse.com/1138939 SUSE Bug 1138939 https://www.suse.com/security/cve/CVE-2019-12904/ SUSE CVE CVE-2019-12904 page openSUSE Leap 15.0 libgcrypt-cavs-1.8.2-lp150.5.10.1 libgcrypt-devel-1.8.2-lp150.5.10.1 libgcrypt-devel-32bit-1.8.2-lp150.5.10.1 libgcrypt20-1.8.2-lp150.5.10.1 libgcrypt20-32bit-1.8.2-lp150.5.10.1 libgcrypt20-hmac-1.8.2-lp150.5.10.1 libgcrypt20-hmac-32bit-1.8.2-lp150.5.10.1 libgcrypt-cavs-1.8.2-lp150.5.10.1 as a component of openSUSE Leap 15.0 libgcrypt-devel-1.8.2-lp150.5.10.1 as a component of openSUSE Leap 15.0 libgcrypt-devel-32bit-1.8.2-lp150.5.10.1 as a component of openSUSE Leap 15.0 libgcrypt20-1.8.2-lp150.5.10.1 as a component of openSUSE Leap 15.0 libgcrypt20-32bit-1.8.2-lp150.5.10.1 as a component of openSUSE Leap 15.0 libgcrypt20-hmac-1.8.2-lp150.5.10.1 as a component of openSUSE Leap 15.0 libgcrypt20-hmac-32bit-1.8.2-lp150.5.10.1 as a component of openSUSE Leap 15.0 ** DISPUTED ** In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack. CVE-2019-12904 openSUSE Leap 15.0:libgcrypt-cavs-1.8.2-lp150.5.10.1 openSUSE Leap 15.0:libgcrypt-devel-1.8.2-lp150.5.10.1 openSUSE Leap 15.0:libgcrypt-devel-32bit-1.8.2-lp150.5.10.1 openSUSE Leap 15.0:libgcrypt20-1.8.2-lp150.5.10.1 openSUSE Leap 15.0:libgcrypt20-32bit-1.8.2-lp150.5.10.1 openSUSE Leap 15.0:libgcrypt20-hmac-1.8.2-lp150.5.10.1 openSUSE Leap 15.0:libgcrypt20-hmac-32bit-1.8.2-lp150.5.10.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html https://www.suse.com/security/cve/CVE-2019-12904.html CVE-2019-12904 https://bugzilla.suse.com/1138939 SUSE Bug 1138939