Summary
[1.0.2k-12.0.1]
- sha256 is used for the RSA pairwise consistency test instead of sha1
[1.0.2k-12]
- fix CVE-2017-3737 - incorrect handling of fatal error state
- fix CVE-2017-3738 - AVX2 Montgomery multiplication bug with 1024 bit modulus
[1.0.2k-11]
- fix deadlock in RNG in the FIPS mode in mariadb
[1.0.2k-9]
- fix CVE-2017-3736 - carry propagation bug in Montgomery multiplication
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | openssl | 1:1.0.2k-12.0.1.el7 |
| Oracle Linux · 7 | openssl-devel | 1:1.0.2k-12.0.1.el7 |
| Oracle Linux · 7 | openssl-libs | 1:1.0.2k-12.0.1.el7 |
| Oracle Linux · 7 | openssl-perl | 1:1.0.2k-12.0.1.el7 |
| Oracle Linux · 7 | openssl-static | 1:1.0.2k-12.0.1.el7 |
Vulnerabilities 3
-
Unscored —CVE-2017-3736 EPSS 10%
There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before …
-
Unscored —CVE-2017-3737 EPSS 79%
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal erro…
-
Unscored —CVE-2017-3738 EPSS 13%
There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli. N…