Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowmoderate severity

Oracle Linux 9: ELSA-2023-0946 Moderate Update for OpenSSL Issues

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2023-0946 https://linux.oracle.com/errata/ELSA-2023-0946.html The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network: x86_64: openssl-3.0.1-47.0.1.el9_1.x86_64.rpm openssl-devel-3.0.1-47.0.1.el9_1.i686.rpm openssl-devel-3.0.1-47.0.1.el9_1.x86_64.rpm openssl-libs-3.0.1-47.0.1.el9_1.i686.rpm openssl-libs-3.0.1-47.0.1.el9_1.x86_64.rpm openssl-perl-3.0.1-47.0.1.el9_1.x86_64.rpm aarch64: openssl-3.0.1-47.0.1.el9_1.aarch64.rpm openssl-devel-3.0.1-47.0.1.el9_1.aarch64.rpm openssl-libs-3.0.1-47.0.1.el9_1.aarch64.rpm openssl-perl-3.0.1-47.0.1.el9_1.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol9/SRPMS-updates//openssl-3.0.1-47.0.1.el9_1.src.rpm Related CVEs: CVE-2022-4203 CVE-2022-4304 CVE-2022-4450 CVE-2023-0215 CVE-2023-0216 CVE-2023-0217 CVE-2023-0286 CVE-2023-0401 Description of changes: [3.0.1-47.0.1] - Replace upstream references [Orabug: 34340177] [1:3.0.1-47] - Fixed X.509 Name Constraints Read Buffer Overflow Resolves: CVE-2022-4203 - Fixed Timing Oracle in RSA Decryption Resolves: CVE-2022-4304 - Fixed Double free after calling PEM_read_bio_ex Resolves: CVE-2022-4450 - Fixed Use-after-free following BIO_new_NDEF Resolves: CVE-2023-0215 - Fixed Invalid pointer dereference in d2i_PKCS7 functions Resolves: CVE-2023-0216 - Fixed NULL dereference validating DSA public key Resolves: CVE-2023-0217 - Fixed X.400 address type confusion in X.509 GeneralName Resolves: CVE-2023-0286 - Fixed NULL dereference during PKCS7 data verification Resolves: CVE-2023-0401 [1:3.0.1-46] - Refactor OpenSSL fips module MAC verification Resolves: rhbz#2158412 - Disallow SHAKE in RSA-OAEP decryption in FIPS mode Resolves: rhbz#2144010 [1:3.0.1-45] - Add support of X25519 and X448 "group" parameter in EVP_PKEY_CTX objects Resolves: rhbz#2149010 - Fix explicit indicator for PSS salt length in FIPS mode when used with negative magic values Resolves: rhbz#2144012 - Update change to default PSS salt length with patch state from upstream Related: rhbz#2144012 [1:3.0.1-44] - SHAKE-128/256 are not allowed with RSA in FIPS mode Resolves: rhbz#2144010 - Avoid memory leaks in TLS Resolves: rhbz#2144008 - FIPS RSA CRT tests must use correct parameters Resolves: rhbz#2144006 - FIPS-140-3 permits only SHA1, SHA256, and SHA512 for DRBG-HASH/DRBG-HMAC Resolves: rhbz#2144017 - Remove support for X9.31 signature padding in FIPS mode Resolves: rhbz#2144015 - Add explicit indicator for SP 800-108 KDFs with short key lengths Resolves: rhbz#2144019 - Add explicit indicator for HMAC with short key lengths Resolves: rhbz#2144000 - Set minimum password length for PBKDF2 in FIPS mode Resolves: rhbz#2144003 - Add explicit indicator for PSS salt length in FIPS mode Resolves: rhbz#2144012 - Clamp default PSS salt length to digest size for FIPS 186-4 compliance Related: rhbz#2144012 - Forbid short RSA keys for key encapsulation/decapsulation in FIPS mode Resolves: rhbz#2145170 _______________________________________________ El-errata mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. https://oss.oracle.com/mailman/listinfo/el-errata . Oracle Linux has released updates addressing urgent OpenSSL security vulnerabilities. It's essential to verify available updates and implement them promptly.. Oracle Linux, OpenSSL, Security Update, Moderate Severity, ELSA-2023-0946. . Severity: Important. LinuxSecurity.com Team

Feb 28, 2023 •Important Oracle