Lucene search

OracleLinuxELSA-2024-0310

HistoryJan 22, 2024 - 12:00 a.m.

openssl security update

2024-01-2200:00:00

linux.oracle.com

openssl

security update

fixes

upstream references

diagnostics

fips checksum

sha1

kdfs

openssl configuration

implicit function declaration

evp_pkey_fromdata

aes-siv cipher

dh keys

sp800-56br2

ecdh public key check

cve-2023-2975

cve-2023-3446

cve-2023-3817

cve-2023-5363

rhel-5317

rhel-5295

rhel-11439

rhel-1780

rhel-5304

rhel-5302

rhel-5306

rhel-5308

rhel-13251

rhel-14083

rhel-15990

rhel-15954

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

45.3%

JSON

[1:3.0.7-25.0.1]

Replace upstream references [Orabug: 34340177]
[1:3.0.7-25]
Provide relevant diagnostics when FIPS checksum is corrupted
Resolves: RHEL-5317
Don’t limit using SHA1 in KDFs in non-FIPS mode.
Resolves: RHEL-5295
Provide empty evp_properties section in main OpenSSL configuration file
Resolves: RHEL-11439
Avoid implicit function declaration when building openssl
Resolves: RHEL-1780
Forbid explicit curves when created via EVP_PKEY_fromdata
Resolves: RHEL-5304
AES-SIV cipher implementation contains a bug that causes it to ignore empty
associated data entries (CVE-2023-2975)
Resolves: RHEL-5302
Excessive time spent checking DH keys and parameters (CVE-2023-3446)
Resolves: RHEL-5306
Excessive time spent checking DH q parameter value (CVE-2023-3817)
Resolves: RHEL-5308
Fix incorrect cipher key and IV length processing (CVE-2023-5363)
Resolves: RHEL-13251
Switch explicit FIPS indicator for RSA-OAEP to approved following
clarification with CMVP
Resolves: RHEL-14083
Backport the check required by SP800-56Br2 6.4.1.2.1 (3.c)
Resolves: RHEL-14083
Add missing ECDH Public Key Check in FIPS mode
Resolves: RHEL-15990
Excessive time spent in DH check/generation with large Q parameter value (CVE-2023-5678)
Resolves: RHEL-15954

OSVersionArchitecturePackageVersionFilename
oracle linux9srcopenssl< 3.0.7-25.0.1.el9_3openssl-3.0.7-25.0.1.el9_3.src.rpm
oracle linux9srcopenssl< 3.0.7-25.0.1.el9_3openssl-3.0.7-25.0.1.el9_3.src.rpm
oracle linux9aarch64openssl< 3.0.7-25.0.1.el9_3openssl-3.0.7-25.0.1.el9_3.aarch64.rpm
oracle linux9aarch64openssl-devel< 3.0.7-25.0.1.el9_3openssl-devel-3.0.7-25.0.1.el9_3.aarch64.rpm
oracle linux9aarch64openssl-libs< 3.0.7-25.0.1.el9_3openssl-libs-3.0.7-25.0.1.el9_3.aarch64.rpm
oracle linux9aarch64openssl-perl< 3.0.7-25.0.1.el9_3openssl-perl-3.0.7-25.0.1.el9_3.aarch64.rpm
oracle linux9srcopenssl< 3.0.7-25.0.1.el9_3openssl-3.0.7-25.0.1.el9_3.src.rpm
oracle linux9srcopenssl< 3.0.7-25.0.1.el9_3openssl-3.0.7-25.0.1.el9_3.src.rpm
oracle linux9x86_64openssl< 3.0.7-25.0.1.el9_3openssl-3.0.7-25.0.1.el9_3.x86_64.rpm
oracle linux9i686openssl-devel< 3.0.7-25.0.1.el9_3openssl-devel-3.0.7-25.0.1.el9_3.i686.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	9	src	openssl	< 3.0.7-25.0.1.el9_3	openssl-3.0.7-25.0.1.el9_3.src.rpm
oracle linux	9	src	openssl	< 3.0.7-25.0.1.el9_3	openssl-3.0.7-25.0.1.el9_3.src.rpm
oracle linux	9	aarch64	openssl	< 3.0.7-25.0.1.el9_3	openssl-3.0.7-25.0.1.el9_3.aarch64.rpm
oracle linux	9	aarch64	openssl-devel	< 3.0.7-25.0.1.el9_3	openssl-devel-3.0.7-25.0.1.el9_3.aarch64.rpm
oracle linux	9	aarch64	openssl-libs	< 3.0.7-25.0.1.el9_3	openssl-libs-3.0.7-25.0.1.el9_3.aarch64.rpm
oracle linux	9	aarch64	openssl-perl	< 3.0.7-25.0.1.el9_3	openssl-perl-3.0.7-25.0.1.el9_3.aarch64.rpm
oracle linux	9	src	openssl	< 3.0.7-25.0.1.el9_3	openssl-3.0.7-25.0.1.el9_3.src.rpm
oracle linux	9	src	openssl	< 3.0.7-25.0.1.el9_3	openssl-3.0.7-25.0.1.el9_3.src.rpm
oracle linux	9	x86_64	openssl	< 3.0.7-25.0.1.el9_3	openssl-3.0.7-25.0.1.el9_3.x86_64.rpm
oracle linux	9	i686	openssl-devel	< 3.0.7-25.0.1.el9_3	openssl-devel-3.0.7-25.0.1.el9_3.i686.rpm