Synopsis: ELSA-2021-3798 can now be patched using Ksplice CVEs: CVE-2021-23480 CVE-2021-23841
Users with Oracle Linux Premier Support can now use Ksplice to patch against the latest Oracle Linux Security Advisory, ELSA-2021-3798. INSTALLING THE UPDATES We recommend that all users of Ksplice on OL 7 install these updates. You can install these updates by running: # ksplice -y user upgrade 32-bit applications should be restarted after upgrading the on-disk openssl RPMs and statically linked applications using openssl should be rebuilt to include these fixes. Ksplice user-space patching requires installation of Ksplice-aware packages and the system must be rebooted after the first installation of these packages. Refer to the installation instructions for the Enhanced Ksplice Client in the Ksplice User's Guide for more details. Systems may be prepared for Ksplice patching by installing the Ksplice aware packages in advance, prior to installing the enhanced Ksplice client. DESCRIPTION * CVE-2021-23480: Integer overflow in EVP functions. An arithmetic error in certain EVP functions can cause applications to crash, or behave unexpectedly. A remote attacker could potentially exploit this flaw to crash a server or client application, or to aid in another type of attack. * CVE-2021-23841: Denial-of-service when generating hashes from x509 certificate. Improper error handling when trying to generate a unique hash from the issuer and serial number of an x509 certificate can result in a NULL pointer dereference, and subsequent application crash. A remote attacker could exploit this flaw to cause a denial-of-service. SUPPORT Ksplice support is available at [email protected]. _______________________________________________ El-errata mailing list [email protected] https://oss.oracle.com/mailman/listinfo/el-errata
