Red Hat_link管理

link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

Topic

An update for openssl is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

openssl: Possible DoS translating ASN.1 object identifiers (CVE-2023-2650)
openssl: Denial of service by excessive resource usage in verifying X509 policy constraints (CVE-2023-0464)
openssl: Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465)
openssl: Certificate policy check not enabled (CVE-2023-0466)
openssl: Input buffer over-read in AES-XTS implementation on 64 bit ARM (CVE-2023-1255)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

In FIPS mode, openssl KDFs should only allow selected hash algorithms (BZ#2175860)
In FIPS mode, openssl should reject short KDF input or output keys or provide an indicator (BZ#2175864)
In FIPS mode, openssl should provide an indicator for AES-GCM to query whether the IV was generated internally or provided externally (BZ#2175868)
openssl FIPS mode self-test should zeroize `out` in `verify_integrity` in providers/fips/self_test.c (BZ#2175873)
In FIPS mode, openssl should not support RSA encryption or decryption without padding (outside of RSASVE) or provide an indicator (BZ#2178029)
In FIPS mode, openssl should reject EVP_PKEY_fromdata() for short DHX keys, or provide an indicator (BZ#2178030)
In FIPS mode, openssl should not use the legacy ECDSA_do_sign(), RSA_public_encrypt(), RSA_private_decrypt() functions for pairwise consistency tests (BZ#2178034)
In FIPS mode, openssl should enter error state when DH PCT fails (BZ#2178039)
In FIPS mode, openssl should always run the PBKDF2 lower bounds checks or provide an indicator when the pkcs5 parameter is set to 1 (BZ#2178137)
Support requiring EMS in TLS 1.2, default to it when in FIPS mode (BZ#2188046)
OpenSSL rsa_verify_recover doesn't use the same key checks as rsa_verify in FIPS mode (BZ#2188052)
RHEL9.0 - sshd dumps core when ibmca engine is configured with default_algorithms = CIPHERS or ALL (openssl) (BZ#2211396)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted.

Affected Products

Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2 x86_64 Red Hat Enterprise Linux Server - AUS 9.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.2 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64 Red Hat Enterprise Linux Server for ARM 64 - 4 years of updates 9.2 aarch64 Red Hat Enterprise Linux Server for IBM z Systems - 4 years of updates 9.2 s390x BZ - 2175860 - In FIPS mode, openssl KDFs should only allow selected hash algorithms [rhel-9.2.0.z] BZ - 2175864 - In FIPS mode, openssl should reject short KDF input or output keys or provide an indicator [rhel-9.2.0.z] BZ - 2175868 - In FIPS mode, openssl should provide an indicator for AES-GCM to query whether the IV was generated internally or provided externally [rhel-9.2.0.z] BZ - 2175873 - openssl FIPS mode self-test should zeroize `out` in `verify_integrity` in providers/fips/self_test.c [rhel-9.2.0.z] BZ - 2178029 - In FIPS mode, openssl should not support RSA encryption or decryption without padding (outside of RSASVE) or provide an indicator [rhel-9.2.0.z] BZ - 2178030 - In FIPS mode, openssl should reject EVP_PKEY_fromdata() for short DHX keys, or provide an indicator [rhel-9.2.0.z] BZ - 2178034 - In FIPS mode, openssl should not use the legacy ECDSA_do_sign(), RSA_public_encrypt(), RSA_private_decrypt() functions for pairwise consistency tests [rhel-9.2.0.z] BZ - 2178039 - In FIPS mode, openssl should enter error state when DH PCT fails [rhel-9.2.0.z] BZ - 2178137 - In FIPS mode, openssl should always run the PBKDF2 lower bounds checks or provide an indicator when the pkcs5 parameter is set to 1 [rhel-9.2.0.z] BZ - 2179379 - In FIPS mode, openssl should indicate that RSA encryption and RSASVE are unapproved [rhel-9.2.0.z] BZ - 2181082 - CVE-2023-0464 openssl: Denial of service by excessive resource usage in verifying X509 policy constraints BZ - 2182561 - CVE-2023-0465 openssl: Invalid certificate policies in leaf certificates are silently ignored BZ - 2182565 - CVE-2023-0466 openssl: Certificate policy check not enabled BZ - 2188046 - Support requiring EMS in TLS 1.2, default to it when in FIPS mode [rhel-9.2.0.z] BZ - 2188052 - OpenSSL rsa_verify_recover doesn't use the same key checks as rsa_verify in FIPS mode [rhel-9.2.0.z] BZ - 2188461 - CVE-2023-1255 openssl: Input buffer over-read in AES-XTS implementation on 64 bit ARM BZ - 2207947 - CVE-2023-2650 openssl: Possible DoS translating ASN.1 object identifiers More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux for x86_64 9

openssl-3.0.7-16.el9_2.src.rpm SHA-256: 8d583eafe1e803c31ea893d363e75589d3da31db6cc0e7e4ff4edb356501da58 x86_64 openssl-3.0.7-16.el9_2.x86_64.rpm SHA-256: 5f7f82d105ac90b5eeebce5643b8bcaf17e70f3a47ceeba914ba961eb8cf954b openssl-debuginfo-3.0.7-16.el9_2.i686.rpm SHA-256: 5677edc5c18b309c77e2f3bc4369aeb22ff07e09bd055f5b7e4c91159a153645 openssl-debuginfo-3.0.7-16.el9_2.i686.rpm SHA-256: 5677edc5c18b309c77e2f3bc4369aeb22ff07e09bd055f5b7e4c91159a153645 openssl-debuginfo-3.0.7-16.el9_2.x86_64.rpm SHA-256: 6e5e12b2ff0c186dec45d7d2877eeb1f638b0ce71098e516ea2358c4d73cea66 openssl-debuginfo-3.0.7-16.el9_2.x86_64.rpm SHA-256: 6e5e12b2ff0c186dec45d7d2877eeb1f638b0ce71098e516ea2358c4d73cea66 openssl-debugsource-3.0.7-16.el9_2.i686.rpm SHA-256: 04f5131f285182e1cdacb5d4ad57c9b548b1f0dd9850b2daf3e6bbc34141fff7 openssl-debugsource-3.0.7-16.el9_2.i686.rpm SHA-256: 04f5131f285182e1cdacb5d4ad57c9b548b1f0dd9850b2daf3e6bbc34141fff7 openssl-debugsource-3.0.7-16.el9_2.x86_64.rpm SHA-256: d8d09c150293f770aef63f79c8376c7f057b632840fe03359db64a096a7d3168 openssl-debugsource-3.0.7-16.el9_2.x86_64.rpm SHA-256: d8d09c150293f770aef63f79c8376c7f057b632840fe03359db64a096a7d3168 openssl-devel-3.0.7-16.el9_2.i686.rpm SHA-256: 6e5dfd04f3504d42b3e7cf532d36c09782ba21f8f6ee86cd71ef65f168bdf19c openssl-devel-3.0.7-16.el9_2.x86_64.rpm SHA-256: df84cdf69253881b12244159a7d57ec69d226ddb4d61af1e85f6b2a39032d140 openssl-libs-3.0.7-16.el9_2.i686.rpm SHA-256: 00338fd18427e7dd5211c4a6fb40482dbd81e67e7a753895c49595d92cc95194 openssl-libs-3.0.7-16.el9_2.x86_64.rpm SHA-256: 0673d6d9e3e47e4995e5481db863080207583fcea9564db8e3b30bffa78ba078 openssl-libs-debuginfo-3.0.7-16.el9_2.i686.rpm SHA-256: 87e75b81d3a80f1f27777c6e4557f305f7314a863a21181388e50459eb7d473c openssl-libs-debuginfo-3.0.7-16.el9_2.i686.rpm SHA-256: 87e75b81d3a80f1f27777c6e4557f305f7314a863a21181388e50459eb7d473c openssl-libs-debuginfo-3.0.7-16.el9_2.x86_64.rpm SHA-256: b5add44e065337a69737ca58704877e96208bac35157e6000a5635104e0fbc6a openssl-libs-debuginfo-3.0.7-16.el9_2.x86_64.rpm SHA-256: b5add44e065337a69737ca58704877e96208bac35157e6000a5635104e0fbc6a openssl-perl-3.0.7-16.el9_2.x86_64.rpm SHA-256: b8d5e4dae58d7b9a03a342a07c278fe1e256f01028d49ad74892f77eae380f9e

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.2

Red Hat Enterprise Linux Server - AUS 9.2

Red Hat Enterprise Linux for IBM z Systems 9

openssl-3.0.7-16.el9_2.src.rpm SHA-256: 8d583eafe1e803c31ea893d363e75589d3da31db6cc0e7e4ff4edb356501da58 s390x openssl-3.0.7-16.el9_2.s390x.rpm SHA-256: 94aaa658904e5cc2e9b62754f0d66e68d8b0179aa4490edf90945e51b1902d0e openssl-debuginfo-3.0.7-16.el9_2.s390x.rpm SHA-256: fcc94f4def232b1c1f3275ce95239d9ac71939dc0873c31f55d222b0e0328ab7 openssl-debuginfo-3.0.7-16.el9_2.s390x.rpm SHA-256: fcc94f4def232b1c1f3275ce95239d9ac71939dc0873c31f55d222b0e0328ab7 openssl-debugsource-3.0.7-16.el9_2.s390x.rpm SHA-256: 3b263697e8fdc98ab78d0930e6ca8b3e8b755ce6cc970819e7a3cbc6c0bee97a openssl-debugsource-3.0.7-16.el9_2.s390x.rpm SHA-256: 3b263697e8fdc98ab78d0930e6ca8b3e8b755ce6cc970819e7a3cbc6c0bee97a openssl-devel-3.0.7-16.el9_2.s390x.rpm SHA-256: 1c8c255ef12714249db97c99f2274f55f00cc653757f69a0e9e9705247a9317c openssl-libs-3.0.7-16.el9_2.s390x.rpm SHA-256: cece6f862e7d2cbf5de67c31f6376af7f5dbd709f7d3c17cab7684ddb839a493 openssl-libs-debuginfo-3.0.7-16.el9_2.s390x.rpm SHA-256: 2b13a598bf134e9abe2e444ea8ee6c231bb534774973cebbc318c225e4f7e49e openssl-libs-debuginfo-3.0.7-16.el9_2.s390x.rpm SHA-256: 2b13a598bf134e9abe2e444ea8ee6c231bb534774973cebbc318c225e4f7e49e openssl-perl-3.0.7-16.el9_2.s390x.rpm SHA-256: 3bbdfea5fe87f1980bee57f01e67d5052235f2643819261da3c307d5c558e9ec

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.2

Red Hat Enterprise Linux for Power, little endian 9

openssl-3.0.7-16.el9_2.src.rpm SHA-256: 8d583eafe1e803c31ea893d363e75589d3da31db6cc0e7e4ff4edb356501da58 ppc64le openssl-3.0.7-16.el9_2.ppc64le.rpm SHA-256: 848d8d540559adafc66e4b2582e1c2e9c4c497a0e27757cb4d9ad73a9849bead openssl-debuginfo-3.0.7-16.el9_2.ppc64le.rpm SHA-256: 7923c7478f1c730c0606000e5b5dc595ef2bcdbce60b892c158f7298a44193ca openssl-debuginfo-3.0.7-16.el9_2.ppc64le.rpm SHA-256: 7923c7478f1c730c0606000e5b5dc595ef2bcdbce60b892c158f7298a44193ca openssl-debugsource-3.0.7-16.el9_2.ppc64le.rpm SHA-256: e0e4ec3c8e5e5452460f9bb9f1067f3337fe32100b64045629ee68a0286baa56 openssl-debugsource-3.0.7-16.el9_2.ppc64le.rpm SHA-256: e0e4ec3c8e5e5452460f9bb9f1067f3337fe32100b64045629ee68a0286baa56 openssl-devel-3.0.7-16.el9_2.ppc64le.rpm SHA-256: f1ff446edb79c4a8ae176c6697964d8067585cbe3afabd078e8ed8f6c6551bde openssl-libs-3.0.7-16.el9_2.ppc64le.rpm SHA-256: a038e169891cbcac6e79460ca6358a34c20b239b20a83f54ee704e7dab242b69 openssl-libs-debuginfo-3.0.7-16.el9_2.ppc64le.rpm SHA-256: 6c1bdc2359c2d4322286c92d5a085b40f8eb06277c8a68e1b0b5baada1de03dc openssl-libs-debuginfo-3.0.7-16.el9_2.ppc64le.rpm SHA-256: 6c1bdc2359c2d4322286c92d5a085b40f8eb06277c8a68e1b0b5baada1de03dc openssl-perl-3.0.7-16.el9_2.ppc64le.rpm SHA-256: b6110a302c1857df51ab367b8a8d320cb3e3910ca44a2f3843eab042b7ddf7d8

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.2

Red Hat Enterprise Linux for ARM 64 9

openssl-3.0.7-16.el9_2.src.rpm SHA-256: 8d583eafe1e803c31ea893d363e75589d3da31db6cc0e7e4ff4edb356501da58 aarch64 openssl-3.0.7-16.el9_2.aarch64.rpm SHA-256: c0486b8b3bae2c3c3257ac4d5ca184658fe14e023f42ae9f501ca8fe4b4d145c openssl-debuginfo-3.0.7-16.el9_2.aarch64.rpm SHA-256: f58d749ff5c0bb618f4d237b09c55177be80332c4ef175d30b2c80836a060035 openssl-debuginfo-3.0.7-16.el9_2.aarch64.rpm SHA-256: f58d749ff5c0bb618f4d237b09c55177be80332c4ef175d30b2c80836a060035 openssl-debugsource-3.0.7-16.el9_2.aarch64.rpm SHA-256: 4043e0273f7397eef32d774fd0dca8d3422203d5f9769313f7698775e598f03e openssl-debugsource-3.0.7-16.el9_2.aarch64.rpm SHA-256: 4043e0273f7397eef32d774fd0dca8d3422203d5f9769313f7698775e598f03e openssl-devel-3.0.7-16.el9_2.aarch64.rpm SHA-256: a5f9a84d2d0955ed9e475c9c79632aa1b890cab62dd41c2311c8d6854b3d1c01 openssl-libs-3.0.7-16.el9_2.aarch64.rpm SHA-256: 5e14e8aa01d4f8a2f0c350c1e417d13b26614d4fec692739edc6b979fc9fc394 openssl-libs-debuginfo-3.0.7-16.el9_2.aarch64.rpm SHA-256: fc9b2b780654b6c70cc1f3414241c5e2298768d7df79c246eac82d9218df4c35 openssl-libs-debuginfo-3.0.7-16.el9_2.aarch64.rpm SHA-256: fc9b2b780654b6c70cc1f3414241c5e2298768d7df79c246eac82d9218df4c35 openssl-perl-3.0.7-16.el9_2.aarch64.rpm SHA-256: 6f738e1d60475f43836c08a25a23cac71801162c73e3f6aad2a513e2197176b2