Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 555
Alerts This Week
Warning Icon 1 555

SUSE: 2023:2522-1 Moderate: OpenSSL Timing Attack Fix for SUSE/SLE15

suse
Calendar Grey August 5, 2023
Dist Suse Esm H88
The SUSE Container suse/sle15 has received crucial updates addressing significant OpenSSL vulnerabilities related to timing attacks and problems with certificate validity.
The container suse/sle15 was updated

Summary

Advisory ID: SUSE-SU-2023:3179-1 Released: Thu Aug 3 13:59:38 2023 Summary: Security update for openssl-1_1 Type: security Severity: moderate

Topics%20covered

Topics Covered

security advisory moderate security update timing attack suse openssl container

References

References : 1201627 1207534 1213487 CVE-2022-4304 CVE-2023-3446

1201627,1207534,1213487,CVE-2022-4304,CVE-2023-3446

This update for openssl-1_1 fixes the following issues:

- CVE-2022-4304: Reworked the fix for the Timing-Oracle in RSA decryption.

The previous fix for this timing side channel turned out to cause a

severe 2-3x performance regression in the typical use case (bsc#1207534).

- CVE-2023-3446: Fixed DH_check() excessive time with over sized modulus (bsc#1213487).

- Update further expiring certificates that affect tests [bsc#1201627]

The following package changes have been done:

- libopenssl1_1-hmac-1.1.1d-150200.11.72.1 updated

- libopenssl1_1-1.1.1d-150200.11.72.1 updated

- openssl-1_1-1.1.1d-150200.11.72.1 updated

Container Advisory ID : SUSE-CU-2023:2522-1
Container Tags : suse/sle15:15.2 , suse/sle15:15.2.9.5.323
Container Release : 9.5.323
Severity : moderate
Type : security

Topics%20covered

Topics Covered

security advisory moderate security update timing attack suse openssl container

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.