Summary
[1:1.1.1k-4.0.1]
- Backport upstream PRs 18446 and 18481 which update
certificates used for the self-tests [Orabug: 34326055]
[1:1.1.1k-4]
- Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
Resolves: rhbz#2063147
- Disable FIPS mode; it does not work and will not be certified
Resolves: rhbz#2091968
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | compat-openssl11 | 1:1.1.1k-4.0.1.el9_0 |
Vulnerabilities 1
-
High 7.5
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…