Red Hat Security Advisory: openssl and openssl-fips-provider security update

Fixed packages 10

Vulnerabilities 7

• Medium 6.5
  CVE-2023-6129

  POLY1305 MAC implementation corrupts vector registers on PowerPC

  Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the internal state of applications running on PowerPC CPU based platforms if the CPU provides vector instructions. Impact summary: If an attacker ca…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 9, 2024
• Medium 5.9
  CVE-2023-6237

  Excessive time spent checking invalid RSA public keys

  Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVP_PKEY_public_check() to check RSA public keys may experience long delays. Where the key that is being checked has been…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Apr 25, 2024
• Medium 5.5
  CVE-2024-0727

  PKCS12 Decoding crashes

  Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 26, 2024
• Medium 5.3
  CVE-2023-2975

  AES-SIV implementation ignores empty associated data entries

  Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries which are unauthenticated as a consequence. Impact summary: Applications that use the AES-SIV algorithm and want to authenticate empty data …

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 14, 2023
• Medium 5.3
  CVE-2023-3446

  Excessive time spent checking DH keys and parameters

  Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 19, 2023
• Medium 5.3
  CVE-2023-3817

  Excessive time spent checking DH q parameter value

  Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jul 31, 2023
• Medium 5.3
  CVE-2023-5678

  Excessive time spent in DH check / generation with large Q parameter value

  Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may experience long delays. L…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 6, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#low
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2223016
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224962
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2227852
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2248616
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257571
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2258502
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2259944
• article
  https://issues.redhat.com/browse/RHEL-14083
• article
  https://issues.redhat.com/browse/RHEL-15990
• article
  https://issues.redhat.com/browse/RHEL-17104
• article
  https://issues.redhat.com/browse/RHEL-17193
• article
  https://issues.redhat.com/browse/RHEL-1780
• article
  https://issues.redhat.com/browse/RHEL-20249
• article
  https://issues.redhat.com/browse/RHEL-5295
• article
  https://issues.redhat.com/browse/RHEL-5304
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2447.json
• report
  https://access.redhat.com/security/cve/CVE-2023-2975
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-2975
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-2975
• article
  https://www.openssl.org/news/secadv/20230714.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-3446
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3446
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3446
• article
  https://www.openssl.org/news/secadv/20230719.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-3817
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3817
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3817
• article
  https://www.openssl.org/news/secadv/20230731.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-5678
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-5678
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-5678
• article
  https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055
• article
  https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c
• article
  https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017
• article
  https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6
• article
  https://www.openssl.org/news/secadv/20231106.txt
• report
  https://access.redhat.com/security/cve/CVE-2023-6129