Summary
[1.0.2k-19.0.1]
- Bump release for rebuild.
[1.0.2k-19]
- close the RSA decryption 9 lives of Bleichenbacher cat
timing side channel (#1649568)
[1.0.2k-18]
- fix CVE-2018-0734 - DSA signature local timing side channel
- fix CVE-2019-1559 - 0-byte record padding oracle
- close the RSA decryption One & done EM side channel (#1619558)
[1.0.2k-17]
- use SHA-256 in FIPS RSA pairwise key check
- fix CVE-2018-5407 (and CVE-2018-0735) - EC signature local
timing side-channel key extraction
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | openssl | 1:1.0.2k-19.0.1.el7 |
| Oracle Linux · 7 | openssl-devel | 1:1.0.2k-19.0.1.el7 |
| Oracle Linux · 7 | openssl-libs | 1:1.0.2k-19.0.1.el7 |
| Oracle Linux · 7 | openssl-perl | 1:1.0.2k-19.0.1.el7 |
| Oracle Linux · 7 | openssl-static | 1:1.0.2k-19.0.1.el7 |
Vulnerabilities 2
-
Unscored —CVE-2018-0734 EPSS 12%
Timing attack against DSA
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.1a (Affected 1.1.1). Fixed in OpenSSL 1.1.0j (Affec…
-
Unscored —CVE-2019-1559 EPSS 17%
0-byte record padding oracle
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding …