openSUSE Security Update: Security update for libressl
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2018:2597-1
Rating:             moderate
References:         #1065363 #1086778 #1097779 
Cross-References:   CVE-2018-12434 CVE-2018-8970
Affected Products:
                    openSUSE Leap 42.3
______________________________________________________________________________

   An update that solves two vulnerabilities and has one
   errata is now available.

Description:

   This update for libressl to version 2.8.0 fixes the following issues:

   Security issues fixed:

   - CVE-2018-12434: Avoid a timing side-channel leak when generating DSA and
     ECDSA signatures. (boo#1097779)
   - Reject excessively large primes in DH key generation.
   - CVE-2018-8970: Fixed a bug in int_x509_param_set_hosts, calling strlen()
     if name length provided is 0 to match the OpenSSL behaviour.
     (boo#1086778)
   - Fixed an out-of-bounds read and crash in DES-fcrypt (boo#1065363)

   You can find a detailed list of changes
   [here](   .txt).


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2018-953=1



Package List:

   - openSUSE Leap 42.3 (i586 x86_64):

      libcrypto43-2.8.0-11.1
      libcrypto43-debuginfo-2.8.0-11.1
      libressl-2.8.0-11.1
      libressl-debuginfo-2.8.0-11.1
      libressl-debugsource-2.8.0-11.1
      libressl-devel-2.8.0-11.1
      libssl45-2.8.0-11.1
      libssl45-debuginfo-2.8.0-11.1
      libtls17-2.8.0-11.1
      libtls17-debuginfo-2.8.0-11.1

   - openSUSE Leap 42.3 (x86_64):

      libcrypto43-32bit-2.8.0-11.1
      libcrypto43-debuginfo-32bit-2.8.0-11.1
      libressl-devel-32bit-2.8.0-11.1
      libssl45-32bit-2.8.0-11.1
      libssl45-debuginfo-32bit-2.8.0-11.1
      libtls17-32bit-2.8.0-11.1
      libtls17-debuginfo-32bit-2.8.0-11.1

   - openSUSE Leap 42.3 (noarch):

      libressl-devel-doc-2.8.0-11.1


References:

   https://www.suse.com/security/cve/CVE-2018-12434.html
   https://www.suse.com/security/cve/CVE-2018-8970.html
   https://bugzilla.suse.com/1065363
   https://bugzilla.suse.com/1086778
   https://bugzilla.suse.com/1097779

--