Skip to content
OpenAdvisories
Medium ELSA-2021-4424 2 CVEs

Moderate: openssl security and bug fix update (Oracle Linux 8)

Published Nov 16, 2021 · Updated Nov 16, 2021

Summary

[1:1.1.1k-4]
- Fixes bugs in s390x AES code.
- Uses the first detected address family if IPv6 is not available
- Reverts the changes in https://github.com/openssl/openssl/pull/13305
as it introduces a regression if server has a DSA key pair, the handshake fails
when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
it has an effect on the 'ssl_reject_handshake' feature in nginx. Although, this feature
will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
known - https://trac.nginx.org/nginx/ticket/2071#comment:1
As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
could early callback instead of servername callback.
- Resolves: rhbz#1978214
- Related: rhbz#1934534

[1:1.1.1k-3]
- Cleansup the peer point formats on renegotiation
- Resolves rhbz#1965362

[1:1.1.1k-2]
- Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
- Using safe primes for FIPS DH self-test

[1.1.1k-1]
- Update to version 1.1.1k

[1.1.1g-16]
- Use AI_ADDRCONFIG only when explicit host name is given
- Allow only curves defined in RFC 8446 in TLS 1.3

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 8 openssl 1:1.1.1k-4.el8
Oracle Linux · 8 openssl-devel 1:1.1.1k-4.el8
Oracle Linux · 8 openssl-libs 1:1.1.1k-4.el8
Oracle Linux · 8 openssl-perl 1:1.1.1k-4.el8

Vulnerabilities 2

  • High 7.5
    CVE-2021-23840 Public exploit EPSS 51%

    Integer overflow in CipherUpdate

    Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the …

  • Medium 5.9
    CVE-2021-23841 Public exploit

    Null pointer deref in X509_issuer_and_serial_hash()

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing …