Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

openSUSE Leap 42.3: 2018:4104-1 Moderate: Timing Attack Fix

opensuse
Calendar Grey December 13, 2018
Dist Opensuse Esm H88
This Fedora Security Update tackles various vulnerabilities present in compat-openssl098.
An update that solves three vulnerabilities and has one errata is now available.

Description

This update for compat-openssl098 fixes the following issues:

Security issues fixed:

- CVE-2018-0734: Fixed timing vulnerability in DSA signature generation

(bsc#1113652).

- CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack

defenses (bsc#1113534).

- CVE-2016-8610: Adjusted current fix and add missing error string

(bsc#1110018).

- Fixed the "One and Done" side-channel attack on RSA (bsc#1104789).

This update was imported from the SUSE:SLE-12:Update update project.

Topics%20covered

Topics Covered

security advisory security update moderate severity timing attack openSUSE compat-openssl

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-1529=1

Package List

- openSUSE Leap 42.3 (i586 x86_64):

compat-openssl098-debugsource-0.9.8j-27.1

libopenssl0_9_8-0.9.8j-27.1

libopenssl0_9_8-debuginfo-0.9.8j-27.1

- openSUSE Leap 42.3 (x86_64):

libopenssl0_9_8-32bit-0.9.8j-27.1

libopenssl0_9_8-debuginfo-32bit-0.9.8j-27.1

References

https://www.suse.com/security/cve/CVE-2016-8610.html

https://www.suse.com/security/cve/CVE-2018-0734.html

https://www.suse.com/security/cve/CVE-2018-5407.html

https://bugzilla.suse.com/1104789

https://bugzilla.suse.com/1110018

https://bugzilla.suse.com/1113534

https://bugzilla.suse.com/1113652

--

Announcement ID: openSUSE-SU-2018:4104-1
Rating: moderate
Affected Products: openSUSE Leap 42.3 le.

Topics%20covered

Topics Covered

security advisory security update moderate severity timing attack openSUSE compat-openssl

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here