Summary
[1.0.2k-24.0.3]
- fix CVE-2022-0778 openssl: Fix possible infinite loop in BN_mod_sqrt()
- Change Epoch from 1 to 10
- Fix DH self-test to add shared secret comparison [Orabug: 32467026]
- Add DH support changes for SP 800-56A rev3 requirements [Orabug: 32467059]
- Add TLS KDF self-test [Orabug: 32467193]
- Add EC keys pairwise consistency test [Orabug: 32467059]
[1.0.2k-24]
- Updates patch openssl-1.0.2k-cve-2021-3712.patch to only free on push failure.
- Resolves: rhbz#2039993
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | openssl | 10:1.0.2k-24.0.3.el7_9_fips |
| Oracle Linux · 7 | openssl-devel | 10:1.0.2k-24.0.3.el7_9_fips |
| Oracle Linux · 7 | openssl-libs | 10:1.0.2k-24.0.3.el7_9_fips |
| Oracle Linux · 7 | openssl-perl | 10:1.0.2k-24.0.3.el7_9_fips |
| Oracle Linux · 7 | openssl-static | 10:1.0.2k-24.0.3.el7_9_fips |
Vulnerabilities 1
-
High 7.5
Infinite loop in BN_mod_sqrt() reachable when parsing certificates
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…