openSUSE Leap 15.2: 2020:3020-1 Moderate: openssl-1_1 Remote Code Execution

This update for openssl-1_1 to 1.1.0i fixes the following issues:

These security issues were fixed:

- CVE-2018-0732: During key agreement in a TLS handshake using a DH(E)

based ciphersuite a malicious server could have sent a very large prime

value to the client. This caused the client to spend an unreasonably

long period of time generating a key for this prime resulting in a hang

until the client has finished. This could be exploited in a Denial Of

Service attack (bsc#1097158)

- Make problematic ECDSA sign addition length-invariant

- Add blinding to ECDSA and DSA signatures to protect against side channel

attacks

These non-security issues were fixed:

- When unlocking a pass phrase protected PEM file or PKCS#8 container, we

now allow empty (zero character) pass phrases.

- Certificate time validation (X509_cmp_time) enforces stricter compliance

with RFC 5280. Fractional seconds and timezone offsets are no longer

...