{"cves":["CVE-2023-6237","CVE-2023-3817","CVE-2023-6129","CVE-2024-0727","CVE-2023-2975","CVE-2023-5678","CVE-2023-3446"],"cvss":0.0,"database_specific":{"severity":"LOW"},"description":"openssl\n[1:3.0.7-27.0.3]\n- Enable openssl-fips-provider dependency [Orabug: 36504822]\n\n[1:3.0.7-27.0.2]\n- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]\n\n[1:3.0.7-27.0.1]\n- Replace upstream references [Orabug: 34340177]\n\n[1:3.0.7-27]\n- Use certified FIPS module instead of freshly built one in Red Hat distribution\n  Related: RHEL-23474\n\n[1:3.0.7-26]\n- Avoid implicit function declaration when building openssl\n  Related: RHEL-1780\n- In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails\n  Resolves: RHEL-17104\n- Add a directory for OpenSSL providers configuration\n  Resolves: RHEL-17193\n- Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context\n  Resolves: RHEL-19515\n- POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)\n  Resolves: RHEL-21151\n- Excessive time spent checking invalid RSA public keys (CVE-2023-6237)\n  Resolves: RHEL-21654\n- SSL ECDHE Kex fails when pkcs11 engine is set in config file\n  Resolves: RHEL-20249\n- Denial of service via null dereference in PKCS#12\n  Resolves: RHEL-22486\n- Use certified FIPS module instead of freshly built one in Red Hat distribution\n  Resolves: RHEL-23474\n\nopenssl-fips-provider\n[3.0.7-2.0.1]\n- Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files [Orabug: 36504822]\n- Replace upstream references [Orabug: 34340177]\n\n[3.0.7-2]\n- Denote conflict with old versions of openssl-libs package\n  Related: RHEL-23474\n\n[3.0.7-1]\nInitial packaging","id":"ELSA-2024-2447","ovalId":"oval:com.oracle.elsa:def:20242447","source":"oracle_linux","title":"ELSA-2024-2447:  openssl and openssl-fips-provider security update (LOW)","url":"https://linux.oracle.com/errata/ELSA-2024-2447.html"}