Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Fedora 41: 2024-e089551039 Moderate: WolfSSL Side-Channel Issues

fedora
Calendar Grey September 13, 2024
Dist Fedora Esm H88
Critical updates for wolfssl in Fedora 41 to improve performance and address side-channel issues.
RHBZ#2308628 RHBZ#2308629 RHBZ#2308630 RHBZ#2308631 fixed in 5.7.2 release

Summary

The wolfSSL embedded SSL library (formerly CyaSSL) is a lightweight SSL/TLS

library written in ANSI C and targeted for embedded, RTOS, and

resource-constrained environments - primarily because of its small size,

speed, and feature set. It is commonly used in standard operating environments

as well because of its royalty-free pricing and excellent cross platform

support. wolfSSL supports industry standards up to the current TLS 1.3 and

DTLS 1.3, is up to 20 times smaller than OpenSSL, and offers progressive

ciphers such as ChaCha20, Curve25519, Blake2b and Post-Quantum TLS 1.3 groups.

User bench-marking and feedback reports dramatically better performance when

using wolfSSL over OpenSSL.

wolfSSL is powered by the wolfCrypt cryptography library. Two versions of

wolfCrypt have been FIPS 140-2 validated (Certificate #2425 and certificate

visit the wolfCrypt FIPS FAQ or contact fips@wolfssl.com.

Update Information:

RHBZ#2308628 RHBZ#2308629 RHBZ#2308630 RHBZ#2308631 fixed in 5.7.2 release

Topics%20covered

Topics Covered

security advisory update Fedora security issues TLS library fault injection wolfssl

Change Log

* Tue Sep 3 2024 Andrew Bauer - 5.7.2-2 - RHBZ#2308628 RHBZ#2308629 RHBZ#2308630 RHBZ#2308631 fixed in 5.7.2 release - fips macro patch no longer needed * Sun Aug 25 2024 Andrew Bauer - 5.7.2-1 - 5.7.2 release - patch FIPS_VERSION3_GE macro issue

References


[ 1 ] Bug #2308628 - CVE-2024-1543 wolfssl: The side-channel protected T-Table implementation in wolfSSL [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2308628 [ 2 ] Bug #2308629 - CVE-2024-1543 wolfssl: The side-channel protected T-Table implementation in wolfSSL [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2308629 [ 3 ] Bug #2308630 - CVE-2024-1545 wolfssl: Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2308630 [ 4 ] Bug #2308631 - CVE-2024-1545 wolfssl: Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2308631

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-e089551039' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Name: wolfssl
Product: Fedora 41
Version: 5.7.2
Release: 2.fc41
URL: https://github.com/wolfSSL/wolfssl
Summary: Lightweight SSL/TLS library written in ANSI C

Topics%20covered

Topics Covered

security advisory update Fedora security issues TLS library fault injection wolfssl

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here