Stay Secure with the Latest Linux Advisories

security advisoryupdateFedora

Fedora 41: 2024-e089551039 Moderate: WolfSSL Side-Channel Issues

RHBZ#2308628 RHBZ#2308629 RHBZ#2308630 RHBZ#2308631 fixed in 5.7.2 release. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-e089551039 2024-09-13 20:43:08.471854 -------------------------------------------------------------------------------- Name : wolfssl Product : Fedora 41 Version : 5.7.2 Release : 2.fc41 URL : https://github.com/wolfSSL/wolfssl Summary : Lightweight SSL/TLS library written in ANSI C Description : The wolfSSL embedded SSL library (formerly CyaSSL) is a lightweight SSL/TLS library written in ANSI C and targeted for embedded, RTOS, and resource-constrained environments - primarily because of its small size, speed, and feature set. It is commonly used in standard operating environments as well because of its royalty-free pricing and excellent cross platform support. wolfSSL supports industry standards up to the current TLS 1.3 and DTLS 1.3, is up to 20 times smaller than OpenSSL, and offers progressive ciphers such as ChaCha20, Curve25519, Blake2b and Post-Quantum TLS 1.3 groups. User bench-marking and feedback reports dramatically better performance when using wolfSSL over OpenSSL. wolfSSL is powered by the wolfCrypt cryptography library. Two versions of wolfCrypt have been FIPS 140-2 validated (Certificate #2425 and certificate visit the wolfCrypt FIPS FAQ or contact This email address is being protected from spambots. You need JavaScript enabled to view it.. -------------------------------------------------------------------------------- Update Information: RHBZ#2308628 RHBZ#2308629 RHBZ#2308630 RHBZ#2308631 fixed in 5.7.2 release -------------------------------------------------------------------------------- ChangeLog: * Tue Sep 3 2024 Andrew Bauer - 5.7.2-2 - RHBZ#2308628 RHBZ#2308629 RHBZ#2308630 RHBZ#2308631 fixed in 5.7.2 release - fips macro patch no longer needed * Sun Aug 25 2024 Andrew Bauer - 5.7.2-1 - 5.7.2 release - patch FIPS_VERSION3_GE macroissue -------------------------------------------------------------------------------- References: [ 1 ] Bug #2308628 - CVE-2024-1543 wolfssl: The side-channel protected T-Table implementation in wolfSSL [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2308628 [ 2 ] Bug #2308629 - CVE-2024-1543 wolfssl: The side-channel protected T-Table implementation in wolfSSL [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2308629 [ 3 ] Bug #2308630 - CVE-2024-1545 wolfssl: Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL [fedora-39] https://bugzilla.redhat.com/show_bug.cgi?id=2308630 [ 4 ] Bug #2308631 - CVE-2024-1545 wolfssl: Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2308631 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-e089551039' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it. Do not reply to spam, report it: .Critical updates for wolfssl in Fedora 41 to improve performance and address side-channel issues.. wolfssl updates,Fedora security,wolfssl vulnerabilities. . LinuxSecurity.com Team

Sep 13, 2024 Fedora