elsa-2024-2447

oracle_linux
Description

openssl [1:3.0.7-27.0.3] - Enable openssl-fips-provider dependency [Orabug: 36504822] [1:3.0.7-27.0.2] - Temporary disable openssl-fips-provider dependency [Orabug: 36504822] [1:3.0.7-27.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.7-27] - Use certified FIPS module instead of freshly built one in Red Hat distribution Related: RHEL-23474 [1:3.0.7-26] - Avoid implicit function declaration when building openssl Related: RHEL-1780 - In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails Resolves: RHEL-17104 - Add a directory for OpenSSL providers configuration Resolves: RHEL-17193 - Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context Resolves: RHEL-19515 - POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129) Resolves: RHEL-21151 - Excessive time spent checking invalid RSA public keys (CVE-2023-6237) Resolves: RHEL-21654 - SSL ECDHE Kex fails when pkcs11 engine is set in config file Resolves: RHEL-20249 - Denial of service via null dereference in PKCS#12 Resolves: RHEL-22486 - Use certified FIPS module instead of freshly built one in Red Hat distribution Resolves: RHEL-23474 openssl-fips-provider [3.0.7-2.0.1] - Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files [Orabug: 36504822] - Replace upstream references [Orabug: 34340177] [3.0.7-2] - Denote conflict with old versions of openssl-libs package Related: RHEL-23474 [3.0.7-1] Initial packaging

Timeline
Published
unknown
Last Modified
unknown
CVSS Details

CVSS details not available.

Affected Products

No product information available.

References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cves": [
    "CVE-2023-6237",
    "CVE-2023-3817",
    "CVE-2023-6129",
    "CVE-2024-0727",
    "CVE-2023-2975",
    "CVE-2023-5678",
    "CVE-2023-3446"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "LOW"
  },
  "description": "openssl\n[1:3.0.7-27.0.3]\n- Enable openssl-fips-provider dependency [Orabug: 36504822]\n\n[1:3.0.7-27.0.2]\n- Temporary disable openssl-fips-provider dependency [Orabug: 36504822]\n\n[1:3.0.7-27.0.1]\n- Replace upstream references [Orabug: 34340177]\n\n[1:3.0.7-27]\n- Use certified FIPS module instead of freshly built one in Red Hat distribution\n  Related: RHEL-23474\n\n[1:3.0.7-26]\n- Avoid implicit function declaration when building openssl\n  Related: RHEL-1780\n- In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails\n  Resolves: RHEL-17104\n- Add a directory for OpenSSL providers configuration\n  Resolves: RHEL-17193\n- Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context\n  Resolves: RHEL-19515\n- POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)\n  Resolves: RHEL-21151\n- Excessive time spent checking invalid RSA public keys (CVE-2023-6237)\n  Resolves: RHEL-21654\n- SSL ECDHE Kex fails when pkcs11 engine is set in config file\n  Resolves: RHEL-20249\n- Denial of service via null dereference in PKCS#12\n  Resolves: RHEL-22486\n- Use certified FIPS module instead of freshly built one in Red Hat distribution\n  Resolves: RHEL-23474\n\nopenssl-fips-provider\n[3.0.7-2.0.1]\n- Add bundle with Oracle Linux 9 OpenSSL FIPS Provider module files [Orabug: 36504822]\n- Replace upstream references [Orabug: 34340177]\n\n[3.0.7-2]\n- Denote conflict with old versions of openssl-libs package\n  Related: RHEL-23474\n\n[3.0.7-1]\nInitial packaging",
  "id": "ELSA-2024-2447",
  "ovalId": "oval:com.oracle.elsa:def:20242447",
  "source": "oracle_linux",
  "title": "ELSA-2024-2447:  openssl and openssl-fips-provider security update (LOW)",
  "url": "https://linux.oracle.com/errata/ELSA-2024-2447.html"
}
View JSON API Download JSON