Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
98
security advisorysecurity updatered hatRedHat: RHSA-2020-1461-01 Important: NSS-Softokn Security Fix
An update for nss-softokn is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: nss-softokn security update Advisory ID: RHSA-2020:1461-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:1461 Issue date: 2020-04-14 CVE Names: CVE-2018-0495 CVE-2019-11745 ==================================================================== 1. Summary: An update for nss-softokn is now available for Red Hat Enterprise Linux 7.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) - x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) - x86_64 Red Hat Enterprise Linux Server EUS (v. 7.6) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x 3. Description: The nss-softokn package provides the Network Security Services Softoken Cryptographic Module. Security Fix(es): * nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate (CVE-2019-11745) * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For detailson how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1591163 - CVE-2018-0495 ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries 1774831 - CVE-2019-11745 nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate 6. Package List: Red Hat Enterprise Linux ComputeNode EUS (v. 7.6): Source: nss-softokn-3.36.0-6.el7_6.src.rpm x86_64: nss-softokn-3.36.0-6.el7_6.i686.rpm nss-softokn-3.36.0-6.el7_6.x86_64.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.i686.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.x86_64.rpm nss-softokn-freebl-3.36.0-6.el7_6.i686.rpm nss-softokn-freebl-3.36.0-6.el7_6.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6): x86_64: nss-softokn-debuginfo-3.36.0-6.el7_6.i686.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.x86_64.rpm nss-softokn-devel-3.36.0-6.el7_6.i686.rpm nss-softokn-devel-3.36.0-6.el7_6.x86_64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.i686.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.x86_64.rpm Red Hat Enterprise Linux Server EUS (v.7.6): Source: nss-softokn-3.36.0-6.el7_6.src.rpm ppc64: nss-softokn-3.36.0-6.el7_6.ppc.rpm nss-softokn-3.36.0-6.el7_6.ppc64.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.ppc.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.ppc64.rpm nss-softokn-devel-3.36.0-6.el7_6.ppc.rpm nss-softokn-devel-3.36.0-6.el7_6.ppc64.rpm nss-softokn-freebl-3.36.0-6.el7_6.ppc.rpm nss-softokn-freebl-3.36.0-6.el7_6.ppc64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.ppc.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.ppc64.rpm ppc64le: nss-softokn-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-devel-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-freebl-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.ppc64le.rpm s390x: nss-softokn-3.36.0-6.el7_6.s390.rpm nss-softokn-3.36.0-6.el7_6.s390x.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.s390.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.s390x.rpm nss-softokn-devel-3.36.0-6.el7_6.s390.rpm nss-softokn-devel-3.36.0-6.el7_6.s390x.rpm nss-softokn-freebl-3.36.0-6.el7_6.s390.rpm nss-softokn-freebl-3.36.0-6.el7_6.s390x.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.s390.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.s390x.rpm x86_64: nss-softokn-3.36.0-6.el7_6.i686.rpm nss-softokn-3.36.0-6.el7_6.x86_64.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.i686.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.x86_64.rpm nss-softokn-devel-3.36.0-6.el7_6.i686.rpm nss-softokn-devel-3.36.0-6.el7_6.x86_64.rpm nss-softokn-freebl-3.36.0-6.el7_6.i686.rpm nss-softokn-freebl-3.36.0-6.el7_6.x86_64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.i686.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.x86_64.rpm Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v.7): Source: nss-softokn-3.36.0-6.el7_6.src.rpm aarch64: nss-softokn-3.36.0-6.el7_6.aarch64.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.aarch64.rpm nss-softokn-devel-3.36.0-6.el7_6.aarch64.rpm nss-softokn-freebl-3.36.0-6.el7_6.aarch64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.aarch64.rpm ppc64le: nss-softokn-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-devel-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-freebl-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.ppc64le.rpm s390x: nss-softokn-3.36.0-6.el7_6.s390.rpm nss-softokn-3.36.0-6.el7_6.s390x.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.s390.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.s390x.rpm nss-softokn-devel-3.36.0-6.el7_6.s390.rpm nss-softokn-devel-3.36.0-6.el7_6.s390x.rpm nss-softokn-freebl-3.36.0-6.el7_6.s390.rpm nss-softokn-freebl-3.36.0-6.el7_6.s390x.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.s390.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.s390x.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-0495 https://access.redhat.com/security/cve/CVE-2019-11745 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBXpX1/NzjgjWX9erEAQgbgA//cmjPu8TwMWsHonboOmXKQZTXbtfVVgo/ 9T/YTJetV/4T3D+cWon1eMLwkZ11OWZHKxvsOfNqcx+DEVa0CwmVVrvBzqzejMkg uuRnfU0ULemUIVBbnFRuN5wvzlrbarUmoilC1uqE/8AxJKtvoAiU0m5Pbcs2je65 r3EcOqwqYSLoI2t6zxU7IGvKI1utG3ZnY5b4DFzMAVrLn0DK0PhKv29ijBWB4S3e haoxib7lehCEPjY35la6ZugC8VUYAjyRlVEnMXLi8Tm0jWcxM5tU+j9F1rsufk2H /Ll3ZMnHfrnlR9Eo0hkiGWGr7zgEerkKfpmrajj00Hziet4DAa9VIDiHqgP5gicl beAnXIczzXQ0mhgrgFZMObXnxpCEDOhO0AWWfmKfj/dcp5lcclZtClNL0ae0Z9d6 RURuVbgeTlYcRASwW7BkKpFMVWzk8LkusA2xuweHv61R/GarOr759tzsLBapb7at vfG2gfBw2CCxILBObT0BsqiDAXpvyS/WlFq19qwLgEc7fLvBc9+2bij66SpB+EeJ IK6xC4WJz+Cn/Tk93xwYj0oFWU5f6H84oL2niKBwtZRorJAoyGcYCqBa0dlMiASO N4sG2/9byTUmmDGW4UMpheMAgDx8UJWdiLIy9WnduZOUWyzzkJ/ms5kyJlG84nBS IAT4DyTF7E0=RrKW -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Apr 14, 2020
•Important
Red Hat
98
security advisoryred hatimportantRed Hat: RHSA-2020-1345-01 Important: nss-softokn Security Fix
An update for nss-softokn is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions.. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: nss-softokn security update Advisory ID: RHSA-2020:1345-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:1345 Issue date: 2020-04-07 CVE Names: CVE-2018-0495 CVE-2019-11745 ==================================================================== 1. Summary: An update for nss-softokn is now available for Red Hat Enterprise Linux 7.4 Advanced Update Support, Red Hat Enterprise Linux 7.4 Telco Extended Update Support, and Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Server AUS (v. 7.4) - x86_64 Red Hat Enterprise Linux Server E4S (v. 7.4) - ppc64le, x86_64 Red Hat Enterprise Linux Server TUS (v. 7.4) - x86_64 3. Description: The nss-softokn package provides the Network Security Services Softoken Cryptographic Module. Security Fix(es): * nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate (CVE-2019-11745) * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply thisupdate, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1591163 - CVE-2018-0495 ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries 1774831 - CVE-2019-11745 nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate 6. Package List: Red Hat Enterprise Linux Server AUS (v. 7.4): Source: nss-softokn-3.28.3-9.el7_4.src.rpm x86_64: nss-softokn-3.28.3-9.el7_4.i686.rpm nss-softokn-3.28.3-9.el7_4.x86_64.rpm nss-softokn-debuginfo-3.28.3-9.el7_4.i686.rpm nss-softokn-debuginfo-3.28.3-9.el7_4.x86_64.rpm nss-softokn-devel-3.28.3-9.el7_4.i686.rpm nss-softokn-devel-3.28.3-9.el7_4.x86_64.rpm nss-softokn-freebl-3.28.3-9.el7_4.i686.rpm nss-softokn-freebl-3.28.3-9.el7_4.x86_64.rpm nss-softokn-freebl-devel-3.28.3-9.el7_4.i686.rpm nss-softokn-freebl-devel-3.28.3-9.el7_4.x86_64.rpm Red Hat Enterprise Linux Server E4S (v. 7.4): Source: nss-softokn-3.28.3-9.el7_4.src.rpm ppc64le: nss-softokn-3.28.3-9.el7_4.ppc64le.rpm nss-softokn-debuginfo-3.28.3-9.el7_4.ppc64le.rpm nss-softokn-devel-3.28.3-9.el7_4.ppc64le.rpm nss-softokn-freebl-3.28.3-9.el7_4.ppc64le.rpm nss-softokn-freebl-devel-3.28.3-9.el7_4.ppc64le.rpm x86_64: nss-softokn-3.28.3-9.el7_4.i686.rpm nss-softokn-3.28.3-9.el7_4.x86_64.rpm nss-softokn-debuginfo-3.28.3-9.el7_4.i686.rpm nss-softokn-debuginfo-3.28.3-9.el7_4.x86_64.rpm nss-softokn-devel-3.28.3-9.el7_4.i686.rpm nss-softokn-devel-3.28.3-9.el7_4.x86_64.rpm nss-softokn-freebl-3.28.3-9.el7_4.i686.rpm nss-softokn-freebl-3.28.3-9.el7_4.x86_64.rpm nss-softokn-freebl-devel-3.28.3-9.el7_4.i686.rpm nss-softokn-freebl-devel-3.28.3-9.el7_4.x86_64.rpm Red Hat Enterprise Linux Server TUS (v.7.4): Source: nss-softokn-3.28.3-9.el7_4.src.rpm x86_64: nss-softokn-3.28.3-9.el7_4.i686.rpm nss-softokn-3.28.3-9.el7_4.x86_64.rpm nss-softokn-debuginfo-3.28.3-9.el7_4.i686.rpm nss-softokn-debuginfo-3.28.3-9.el7_4.x86_64.rpm nss-softokn-devel-3.28.3-9.el7_4.i686.rpm nss-softokn-devel-3.28.3-9.el7_4.x86_64.rpm nss-softokn-freebl-3.28.3-9.el7_4.i686.rpm nss-softokn-freebl-3.28.3-9.el7_4.x86_64.rpm nss-softokn-freebl-devel-3.28.3-9.el7_4.i686.rpm nss-softokn-freebl-devel-3.28.3-9.el7_4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-0495 https://access.redhat.com/security/cve/CVE-2019-11745 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXoxI5dzjgjWX9erEAQiD+hAAkAnoav5FMltQo/IdtfRZMwhxS9N0Y6W4 H/xwgg/jipCZ61vE/STaMM44zJWSzTayme8nslELtqRsijY9GdhZwH0lLrtYbVEJ sdWliYxfPwzlqokaIi9HcnbDok2xYrhbM5wfzSMcvE2Coq8yoo4++Nrlv0m7cxNE dAVJZNi594WBeiNdffFfoGBLFewr+qcfLwd20hQpjji74V/r+Q6fj4BHp7ilU5qU 0s/0lEFzCr4vOXYrIe58P4DRhcO4C8W5qAVDAtjx4cXGkUPIjbcO2JJE7ywlFajp 5EBgZeJK9f7MbWGXMjEOGJhPDt0uykj2f8AGZKZxh4Az4GyijMQMYKRkiwBy4HRd BBb0hCti/phfzx2enk5Z39e1tAX91h3nlzAbWQbcEOmvrcudxjnxkM9DTh9h5nQZ eHN9kE18KrYExvJXA5seWD/p/LBW5DXaaumKcHXiKoS6d+O+D43DwvUpzdl2JP+e 57xTskKOrZzk1h7O+1LoEstTI7bqTnYH7VCfIQEdgKBG3AQ2t5O8vfWFLKF7AjXX CoYdmT0cMtu2r00Scr7JSs45hQ/Yy0bBiUSlvDKNnVhsr45EscG5pAVVzID5DlCh cMol1vhCBoV53UfQ3wkZiqMcxsJxNC5ajN9Q7lZgejg2zA1bGySrXALlg13t3ZIH olEFz/LzYms=XO4i -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Apr 07, 2020
•Important
Red Hat
200
security advisorymoderateupdateSciLinux: SLSA-2019-2237-1 Moderate: Key Extraction and Cache Issues
ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495) * nss: Cache side-channel variant of the Bleichenbacher attack (CVE-2018-12404) SL7 x86_64 nss-softokn-3.44.0-5.el7.x86_64.rpm nss-devel-3.44.0-4.el7.i686.rpm nss-softokn-freebl-3.44.0-5.el7.i686.rpm nspr-devel-4.21.0-1.el7.i686.rpm nss-devel-3.44.0-4.el7.x86_64.rpm nss-tools-3.44.0-4.el [More...]. Synopsis: Moderate: nss, nss-softokn, nss-util, and nspr security, bug Advisory ID: SLSA-2019:2237-1 Issue Date: 2019-08-06 CVE Numbers: CVE-2018-0495 CVE-2018-12404 -- Netscape Portable Runtime (NSPR) provides platform independence for non- GUI operating system facilities. The following packages have been upgraded to a later upstream version: nss (3.44.0), nss-softokn (3.44.0), nss-util (3.44.0), nspr (4.21.0). Security Fix(es): * ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495) * nss: Cache side-channel variant of the Bleichenbacher attack (CVE-2018-12404) -- SL7 x86_64 nss-softokn-3.44.0-5.el7.x86_64.rpm nss-devel-3.44.0-4.el7.i686.rpm nss-softokn-freebl-3.44.0-5.el7.i686.rpm nspr-devel-4.21.0-1.el7.i686.rpm nss-devel-3.44.0-4.el7.x86_64.rpm nss-tools-3.44.0-4.el7.x86_64.rpm nss-softokn-devel-3.44.0-5.el7.i686.rpm nss-sysinit-3.44.0-4.el7.x86_64.rpm nss-util-devel-3.44.0-3.el7.x86_64.rpm nspr-4.21.0-1.el7.x86_64.rpm nspr-devel-4.21.0-1.el7.x86_64.rpm nss-util-3.44.0-3.el7.x86_64.rpm nss-softokn-freebl-devel-3.44.0-5.el7.x86_64.rpm nss-softokn-freebl-devel-3.44.0-5.el7.i686.rpm nss-softokn-3.44.0-5.el7.i686.rpm nss-util-devel-3.44.0-3.el7.i686.rpm nss-softokn-devel-3.44.0-5.el7.x86_64.rpm nss-3.44.0-4.el7.i686.rpm nspr-4.21.0-1.el7.i686.rpm nss-3.44.0-4.el7.x86_64.rpm nss-util-3.44.0-3.el7.i686.rpm nss-softokn-freebl-3.44.0-5.el7.x86_64.rpm nss-pkcs11-devel-3.44.0-4.el7.i686.rpm nss-pkcs11-devel-3.44.0-4.el7.x86_64.rpm nspr-debuginfo-4.21.0-1.el7.i686.rpm nspr-debuginfo-4.21.0-1.el7.x86_64.rpm nss-debuginfo-3.44.0-4.el7.i686.rpm nss-debuginfo-3.44.0-4.el7.x86_64.rpm nss-softokn-debuginfo-3.44.0-5.el7.i686.rpm nss-softokn-debuginfo-3.44.0-5.el7.x86_64.rpm nss-util-debuginfo-3.44.0-3.el7.i686.rpm nss-util-debuginfo-3.44.0-3.el7.x86_64.rpm - Scientific Linux Development Team . Concise notice on updates for nss, nss-softokn, nss-util, and nspr, focusing on resolutions for key extraction vulnerabilities and side-channel threats.. nss softokn update, crypto library advisory, SL7 patch details, cache side-channel fix. . LinuxSecurity.com Team
Aug 26, 2019
Scientific Linux
200
security advisorymoderatedenial of serviceSciLinux: SLSA-2018-3221-1 Important: openssl Vulnerabilities and Risks
openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495) * openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang (CVE-2018-0732) * openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service (CVE-2018-0739) * openssl: Malformed X.509 IPAdressFamily [More...]. Synopsis: Moderate: openssl security, bug fix, and enhancement Advisory ID: SLSA-2018:3221-1 Issue Date: 2018-10-30 CVE Numbers: CVE-2018-0739 CVE-2017-3735 CVE-2018-0737 CVE-2018-0732 CVE-2018-0495 -- Security Fix(es): * openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495) * openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang (CVE-2018-0732) * openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service (CVE-2018-0739) * openssl: Malformed X.509 IPAdressFamily could cause OOB read (CVE-2017-3735) * openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) -- SL7 x86_64 openssl-1.0.2k-16.el7.x86_64.rpm openssl-debuginfo-1.0.2k-16.el7.i686.rpm openssl-debuginfo-1.0.2k-16.el7.x86_64.rpm openssl-libs-1.0.2k-16.el7.i686.rpm openssl-libs-1.0.2k-16.el7.x86_64.rpm openssl-devel-1.0.2k-16.el7.i686.rpm openssl-devel-1.0.2k-16.el7.x86_64.rpm openssl-perl-1.0.2k-16.el7.x86_64.rpm openssl-static-1.0.2k-16.el7.i686.rpm openssl-static-1.0.2k-16.el7.x86_64.rpm - Scientific Linux Development Team . Important bulletin addressing openssl security patches and improvements, notably regarding service interruptions and private key breaches.. openssl fix, SL7 security, crypto library updates. . Severity: Important. LinuxSecurity.com Team
Nov 26, 2018
•Important
Scientific Linux
98
security advisorydenial of servicebug fixRed Hat: RHSA-2018-3221 Security Update for OpenSSL Issues
An update for openssl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: openssl security, bug fix, and enhancement update Advisory ID: RHSA-2018:3221-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2018:3221 Issue date: 2018-10-30 CVE Names: CVE-2017-3735 CVE-2018-0495 CVE-2018-0732 CVE-2018-0737 CVE-2018-0739 ==================================================================== 1. Summary: An update for openssl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Client (v. 7) - x86_64 Red Hat Enterprise Linux Client Optional (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64 Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64 Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 7) - x86_64 Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) - aarch64, ppc64le, s390x 3. Description: OpenSSL is a toolkit that implements theSecure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495) * openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang (CVE-2018-0732) * openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service (CVE-2018-0739) * openssl: Malformed X.509 IPAdressFamily could cause OOB read (CVE-2017-3735) * openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. 5. Bugs fixed (https://bugzilla.redhat.com/): 1486144 - CVE-2017-3735 openssl: Malformed X.509 IPAdressFamily could cause OOB read 1548401 - modify X509_NAME comparison function to be case sensitive for CA name lists in SSL 1561266 - CVE-2018-0739 openssl: Handling of crafted recursive ASN.1 structures can cause a stack overflow and resulting denial of service 1568253 - CVE-2018-0737 openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys 1585004 - ppc64le opensslconf.h is incompatible with swig 1591100 - CVE-2018-0732 openssl: Malicious server can send large prime to client during DH(E) TLS handshake causing the client tohang 1591163 - CVE-2018-0495 openssl: ROHNP - Key Extraction Side Channel in Multiple Crypto Libraries 1603597 - Confusing error message when asking for invalid DSA parameter sizes in FIPS mode 6. Package List: Red Hat Enterprise Linux Client (v. 7): Source: openssl-1.0.2k-16.el7.src.rpm x86_64: openssl-1.0.2k-16.el7.x86_64.rpm openssl-debuginfo-1.0.2k-16.el7.i686.rpm openssl-debuginfo-1.0.2k-16.el7.x86_64.rpm openssl-libs-1.0.2k-16.el7.i686.rpm openssl-libs-1.0.2k-16.el7.x86_64.rpm Red Hat Enterprise Linux Client Optional (v. 7): x86_64: openssl-debuginfo-1.0.2k-16.el7.i686.rpm openssl-debuginfo-1.0.2k-16.el7.x86_64.rpm openssl-devel-1.0.2k-16.el7.i686.rpm openssl-devel-1.0.2k-16.el7.x86_64.rpm openssl-perl-1.0.2k-16.el7.x86_64.rpm openssl-static-1.0.2k-16.el7.i686.rpm openssl-static-1.0.2k-16.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode (v. 7): Source: openssl-1.0.2k-16.el7.src.rpm x86_64: openssl-1.0.2k-16.el7.x86_64.rpm openssl-debuginfo-1.0.2k-16.el7.i686.rpm openssl-debuginfo-1.0.2k-16.el7.x86_64.rpm openssl-libs-1.0.2k-16.el7.i686.rpm openssl-libs-1.0.2k-16.el7.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional (v. 7): x86_64: openssl-debuginfo-1.0.2k-16.el7.i686.rpm openssl-debuginfo-1.0.2k-16.el7.x86_64.rpm openssl-devel-1.0.2k-16.el7.i686.rpm openssl-devel-1.0.2k-16.el7.x86_64.rpm openssl-perl-1.0.2k-16.el7.x86_64.rpm openssl-static-1.0.2k-16.el7.i686.rpm openssl-static-1.0.2k-16.el7.x86_64.rpm Red Hat Enterprise Linux Server (v.7): Source: openssl-1.0.2k-16.el7.src.rpm ppc64: openssl-1.0.2k-16.el7.ppc64.rpm openssl-debuginfo-1.0.2k-16.el7.ppc.rpm openssl-debuginfo-1.0.2k-16.el7.ppc64.rpm openssl-devel-1.0.2k-16.el7.ppc.rpm openssl-devel-1.0.2k-16.el7.ppc64.rpm openssl-libs-1.0.2k-16.el7.ppc.rpm openssl-libs-1.0.2k-16.el7.ppc64.rpm ppc64le: openssl-1.0.2k-16.el7.ppc64le.rpm openssl-debuginfo-1.0.2k-16.el7.ppc64le.rpm openssl-devel-1.0.2k-16.el7.ppc64le.rpm openssl-libs-1.0.2k-16.el7.ppc64le.rpm s390x: openssl-1.0.2k-16.el7.s390x.rpm openssl-debuginfo-1.0.2k-16.el7.s390.rpm openssl-debuginfo-1.0.2k-16.el7.s390x.rpm openssl-devel-1.0.2k-16.el7.s390.rpm openssl-devel-1.0.2k-16.el7.s390x.rpm openssl-libs-1.0.2k-16.el7.s390.rpm openssl-libs-1.0.2k-16.el7.s390x.rpm x86_64: openssl-1.0.2k-16.el7.x86_64.rpm openssl-debuginfo-1.0.2k-16.el7.i686.rpm openssl-debuginfo-1.0.2k-16.el7.x86_64.rpm openssl-devel-1.0.2k-16.el7.i686.rpm openssl-devel-1.0.2k-16.el7.x86_64.rpm openssl-libs-1.0.2k-16.el7.i686.rpm openssl-libs-1.0.2k-16.el7.x86_64.rpm Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7): Source: openssl-1.0.2k-16.el7.src.rpm aarch64: openssl-1.0.2k-16.el7.aarch64.rpm openssl-debuginfo-1.0.2k-16.el7.aarch64.rpm openssl-devel-1.0.2k-16.el7.aarch64.rpm openssl-libs-1.0.2k-16.el7.aarch64.rpm ppc64le: openssl-1.0.2k-16.el7.ppc64le.rpm openssl-debuginfo-1.0.2k-16.el7.ppc64le.rpm openssl-devel-1.0.2k-16.el7.ppc64le.rpm openssl-libs-1.0.2k-16.el7.ppc64le.rpm s390x: openssl-1.0.2k-16.el7.s390x.rpm openssl-debuginfo-1.0.2k-16.el7.s390.rpm openssl-debuginfo-1.0.2k-16.el7.s390x.rpm openssl-devel-1.0.2k-16.el7.s390.rpm openssl-devel-1.0.2k-16.el7.s390x.rpm openssl-libs-1.0.2k-16.el7.s390.rpm openssl-libs-1.0.2k-16.el7.s390x.rpm Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v.7): aarch64: openssl-debuginfo-1.0.2k-16.el7.aarch64.rpm openssl-perl-1.0.2k-16.el7.aarch64.rpm openssl-static-1.0.2k-16.el7.aarch64.rpm ppc64le: openssl-debuginfo-1.0.2k-16.el7.ppc64le.rpm openssl-perl-1.0.2k-16.el7.ppc64le.rpm openssl-static-1.0.2k-16.el7.ppc64le.rpm s390x: openssl-debuginfo-1.0.2k-16.el7.s390.rpm openssl-debuginfo-1.0.2k-16.el7.s390x.rpm openssl-perl-1.0.2k-16.el7.s390x.rpm openssl-static-1.0.2k-16.el7.s390.rpm openssl-static-1.0.2k-16.el7.s390x.rpm Red Hat Enterprise Linux Server Optional (v. 7): ppc64: openssl-debuginfo-1.0.2k-16.el7.ppc.rpm openssl-debuginfo-1.0.2k-16.el7.ppc64.rpm openssl-perl-1.0.2k-16.el7.ppc64.rpm openssl-static-1.0.2k-16.el7.ppc.rpm openssl-static-1.0.2k-16.el7.ppc64.rpm ppc64le: openssl-debuginfo-1.0.2k-16.el7.ppc64le.rpm openssl-perl-1.0.2k-16.el7.ppc64le.rpm openssl-static-1.0.2k-16.el7.ppc64le.rpm s390x: openssl-debuginfo-1.0.2k-16.el7.s390.rpm openssl-debuginfo-1.0.2k-16.el7.s390x.rpm openssl-perl-1.0.2k-16.el7.s390x.rpm openssl-static-1.0.2k-16.el7.s390.rpm openssl-static-1.0.2k-16.el7.s390x.rpm x86_64: openssl-debuginfo-1.0.2k-16.el7.i686.rpm openssl-debuginfo-1.0.2k-16.el7.x86_64.rpm openssl-perl-1.0.2k-16.el7.x86_64.rpm openssl-static-1.0.2k-16.el7.i686.rpm openssl-static-1.0.2k-16.el7.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 7): Source: openssl-1.0.2k-16.el7.src.rpm x86_64: openssl-1.0.2k-16.el7.x86_64.rpm openssl-debuginfo-1.0.2k-16.el7.i686.rpm openssl-debuginfo-1.0.2k-16.el7.x86_64.rpm openssl-devel-1.0.2k-16.el7.i686.rpm openssl-devel-1.0.2k-16.el7.x86_64.rpm openssl-libs-1.0.2k-16.el7.i686.rpm openssl-libs-1.0.2k-16.el7.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 7): x86_64: openssl-debuginfo-1.0.2k-16.el7.i686.rpm openssl-debuginfo-1.0.2k-16.el7.x86_64.rpm openssl-perl-1.0.2k-16.el7.x86_64.rpm openssl-static-1.0.2k-16.el7.i686.rpm openssl-static-1.0.2k-16.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are availablefrom https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-3735 https://access.redhat.com/security/cve/CVE-2018-0495 https://access.redhat.com/security/cve/CVE-2018-0732 https://access.redhat.com/security/cve/CVE-2018-0737 https://access.redhat.com/security/cve/CVE-2018-0739 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW9gQkdzjgjWX9erEAQgQZQ/8CfvagNmJ9p3eWlbk5NOClhF4mxZjzHUc j8kOWrBXKt+VsCknJJTwKOkzrljUJ/XgHo4vu/G9F6O3Oj62roWmW5OJKtlmD3xl VOhUNNmWalVsQ1i1CgI7Khf2Xq9SaMnCaTDpoTamAAznrcj7T2AGABIzPeK0+WL7 GctOtuZoC04CSUbg4z3I6KWYZAh9Id6qbYLcMYSNbTGW7FKl15GOQsu2atwwoWhg 9BA6QhEULWiob/MWcGIrZZl3Bqm2cngC+FhxklsWJ9BC0zRsCJZROBg2eYVCwW78 ZwXiS5rQCSNkmGO4GK239aSyjMmtwrZBzfLsFXz1Enp7kKle6EqnA655p4cu78I8 HXxmBOceOq7NlG3Zz4PKafmkqZMHoriIxGDgGYWxMBb2Tdk7ZerhsaA1fW9dDPIZ zNxF0LngoaZbu49DKv/Doiqcs9nsyvoYpBMeALAM1hAZRhk7o31HJS9i7O/YzuWc uL7wgtQRgyxtFXaRlleWU8pWsTx9NtpvtPiMJQzkw19UX3El5DQv+8x+hNholuZa pfA9UWrhLfYVk0ZZRzI9pYgpsEJ9Ga3TgykpM048V4+84KVDRkkLHxGM1p3rvX01 eCRYyB0VzbFhKwxdyRniBITh3e2+uaYkG7zYSX+ewXu2rOTN8uLrK87rHDliQnvS nuWE/iwTIDU=jMog -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Oct 30, 2018
Red Hat
89
security advisoryfedoracriticalFedora 29: FEDORA-2018-a5b667d1f9 Severe: LibTomCrypt Buffer Overflow
- Fix Side Channel Based ECDSA Key Extraction (CVE-2018-12437) (PR #408) - Fix potential stack overflow when DER flexi-decoding (CVE-2018-0739) (PR #373) - Fix two-key 3DES (PR #390) - Fix accelerated CTR mode (PR #359) - Fix Fortuna PRNG (PR #363) - Fix compilation on platforms where cc doesn't point to gcc (PR #382) - Fix using the wrong environment variable LT instead of LIBTOOL (PR #392) - Fix [More...]. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2018-9d667bdff8 2018-07-19 18:02:50.871311 --------------------------------------------------------------------------------Name : libtomcrypt Product : Fedora 28 Version : 1.18.2 Release : 1.fc28 URL : https://www.libtom.net/ Summary : A comprehensive, portable cryptographic toolkit Description : A comprehensive, modular and portable cryptographic toolkit that provides developers with a vast array of well known published block ciphers, one-way hash functions, chaining modes, pseudo-random number generators, public key cryptography and a plethora of other routines. Designed from the ground up to be very simple to use. It has a modular and standard API that allows new ciphers, hashes and PRNGs to be added or removed without change to the overall end application. It features easy to use functions and a complete user manual which has many source snippet examples. --------------------------------------------------------------------------------Update Information: - Fix Side Channel Based ECDSA Key Extraction (CVE-2018-12437) (PR #408) - Fix potential stack overflow when DER flexi-decoding (CVE-2018-0739) (PR #373) - Fix two-key 3DES (PR #390) - Fix accelerated CTR mode (PR #359) - Fix Fortuna PRNG (PR #363) - Fix compilation on platforms where cc doesn't point to gcc (PR #382) - Fix using the wrong environment variable LT instead of LIBTOOL (PR #392) - Fix build on platforms where the compiler provides __WCHAR_MAX__ but wchar.h isnot available (PR #390) - Fix & re-factor crypt_list_all_sizes() and crypt_list_all_constants() (PR #414) - Minor fixes (PR's #350 #351 #375 #377 #378 #379) --------------------------------------------------------------------------------ChangeLog: * Sun Jul 8 2018 Simone Caronni - 1.18.2-1 - Udpate to 1.18.2. * Wed Apr 18 2018 Simone Caronni - 1.18.1-5 - Update build requirement for texlive rebase. * Mon Apr 9 2018 Rafael Santos - 1.18.1-4 - Fix missing Fedora linker flags (bug #1548709) --------------------------------------------------------------------------------References: [ 1 ] Bug #1591906 - CVE-2018-12437 libtomcrypt: memory-cache side-channel attack on ECDSA signatures [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=1591906 [ 2 ] Bug #1591905 - CVE-2018-12437 libtomcrypt: memory-cache side-channel attack on ECDSA signatures [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1591905 [ 3 ] Bug #1548709 - libtomcrypt: Partial build flags injection https://bugzilla.redhat.com/show_bug.cgi?id=1548709 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2018-9d667bdff8' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Jul 19, 2018
Fedora
91
security advisorygentoonormalGentoo Libgcrypt GLSA-201408-10 Normal: ElGamal Key Extraction Risk
A vulnerability in Libgcrypt could allow a remote attacker to extract ElGamal private key information.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201408-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Libgcrypt: Side-channel attack Date: August 29, 2014 Bugs: #519396 ID: 201408-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in Libgcrypt could allow a remote attacker to extract ElGamal private key information. Background ========= Libgcrypt is a general purpose cryptographic library derived out of GnuPG. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/libgcrypt < 1.5.4 > = 1.5.4 Description ========== A vulnerability in the implementation of ElGamal decryption procedures of Libgcrypt leaks information to various side-channels. Impact ===== A physical side-channel attack allows a remote attacker to fully extract decryption keys during the decryption of a chosen ciphertext. Workaround ========= There is no known workaround at this time. Resolution ========= All Libgcrypt users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-libs/libgcrypt-1.5.4" References ========= [ 1 ] CVE-2014-5270 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5270 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201408-10 Concerns? ======== Security is a primary focusof Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Aug 29, 2014
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!