{
  "cves": [
    "CVE-2023-6237",
    "CVE-2023-3817",
    "CVE-2023-6129",
    "CVE-2024-0727",
    "CVE-2023-2975",
    "CVE-2023-5678",
    "CVE-2023-3446"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "LOW"
  },
  "description": "openssl\n[1:3.0.7-27.0.3]\n- Enable openssl-fips-provider dependency [Orabug: 36504822]\n\n[1:3.0.7-27.0.2]\n- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]\n\n[1:3.0.7-27.0.1]\n- Replace upstream references [Orabug: 34340177]\n\n[1:3.0.7-27]\n- Use certified FIPS module instead of freshly built one in Red Hat distribution\n  Related: RHEL-23474\n\n[1:3.0.7-26]\n- Avoid implicit function declaration when building openssl\n  Related: RHEL-1780\n- In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails\n  Resolves: RHEL-17104\n- Add a directory for OpenSSL providers configuration\n  Resolves: RHEL-17193\n- Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context\n  Resolves: RHEL-19515\n- POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)\n  Resolves: RHEL-21151\n- Excessive time spent checking invalid RSA public keys (CVE-2023-6237)\n  Resolves: RHEL-21654\n- SSL ECDHE Kex fails when pkcs11 engine is set in config file\n  Resolves: RHEL-20249\n- Denial of service via null dereference in PKCS#12\n  Resolves: RHEL-22486\n- Use certified FIPS module instead of freshly built one in Red Hat distribution\n  Resolves: RHEL-23474\n\nopenssl-fips-provider\n[3.0.7-2.0.1]\n- Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files [Orabug: 36504822]\n- Replace upstream references [Orabug: 34340177]\n\n[3.0.7-2]\n- Denote conflict with old versions of openssl-libs package\n  Related: RHEL-23474\n\n[3.0.7-1]\nInitial packaging",
  "id": "ELSA-2024-2447",
  "ovalId": "oval:com.oracle.elsa:def:20242447",
  "source": "oracle_linux",
  "title": "ELSA-2024-2447:  openssl and openssl-fips-provider security update (LOW)",
  "url": "https://linux.oracle.com/errata/ELSA-2024-2447.html"
}