#9979: OpenSSL-1.1.0g OpenSSL-1.0.2m
-------------------------+-------------------------
Reporter: renodr | Owner: blfs-book@…
Type: enhancement | Status: new
Priority: normal | Milestone: 8.2
Component: BOOK | Version: SVN
Severity: normal | Keywords:
-------------------------+-------------------------
New point versions (security releases just came out about two hours ago)
{{{
OpenSSL Security Advisory [02 Nov 2017]
========================================
bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
======================================================
Severity: Moderate
There is a carry propagating bug in the x86_64 Montgomery squaring
procedure. No
EC algorithms are affected. Analysis suggests that attacks against RSA and
DSA
as a result of this defect would be very difficult to perform and are not
believed likely. Attacks against DH are considered just feasible (although
very
difficult) because most of the work necessary to deduce information
about a private key may be performed offline. The amount of resources
required for such an attack would be very significant and likely only
accessible to a limited number of attackers. An attacker would
additionally need online access to an unpatched system using the target
private key in a scenario with persistent DH parameters and a private
key that is shared between multiple clients.
This only affects processors that support the BMI1, BMI2 and ADX
extensions like
Intel Broadwell (5th generation) and later or AMD Ryzen.
Note: This issue is very similar to CVE-2017-3732 and CVE-2015-3193 but
must be
treated as a separate problem.
OpenSSL 1.1.0 users should upgrade to 1.1.0g
OpenSSL 1.0.2 users should upgrade to 1.0.2m
This issue was reported to OpenSSL on 10th August 2017 by the OSS-Fuzz
project.
The fix was developed by Andy Polyakov of the OpenSSL development team.
Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
====================================================================
Severity: Low
This issue was previously announced in security advisory
https://www.openssl.org/news/secadv/20170828.txt, but the fix has not
previously
been included in a release due to its low severity.
OpenSSL 1.1.0 users should upgrade to 1.1.0g
OpenSSL 1.0.2 users should upgrade to 1.0.2m
Note
====
Support for version 1.0.1 ended on 31st December 2016. Support for
versions
0.9.8 and 1.0.0 ended on 31st December 2015. Those versions are no longer
receiving security updates.
}}}
--
Ticket URL: <http://wiki.linuxfromscratch.org/blfs/ticket/9979>
BLFS Trac <http://wiki.linuxfromscratch.org/blfs>
Beyond Linux From Scratch
--
http://lists.linuxfromscratch.org/listinfo/blfs-book
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page
