SUSE-SU-2018:2928-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:2928-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2018:2928-1
- Related
- Published
- 2018-09-28T06:01:41Z
- Modified
- 2018-09-28T06:01:41Z
- Summary
- Security update for openssl
- Details
-
This update for openssl fixes the following issues:
These security issues were fixed:
- Prevent One&Done side-channel attack on RSA that allowed physically near attackers to use EM emanations to recover information (bsc#1104789)
- CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039)
These non-security issues were fixed:
- Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470)
- Fixed path to the engines which are under /lib64 on SLE-12 (bsc#1101246, bsc#997043)
- References
-
- https://www.suse.com/support/update/announcement/2018/suse-su-20182928-1/
- https://bugzilla.suse.com/1089039
- https://bugzilla.suse.com/1101246
- https://bugzilla.suse.com/1101470
- https://bugzilla.suse.com/1104789
- https://bugzilla.suse.com/1106197
- https://bugzilla.suse.com/997043
- https://www.suse.com/security/cve/CVE-2018-0737
Affected packages
SUSE:OpenStack Cloud 7 / openssl
Package
- Name
- openssl
- Purl
- purl:rpm/suse/openssl&distro=SUSE%20OpenStack%20Cloud%207
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.0.2j-60.39.1
Ecosystem specific
{
"binaries": [
{
"libopenssl-devel": "1.0.2j-60.39.1",
"openssl-doc": "1.0.2j-60.39.1",
"openssl": "1.0.2j-60.39.1",
"libopenssl1_0_0": "1.0.2j-60.39.1",
"libopenssl1_0_0-32bit": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac-32bit": "1.0.2j-60.39.1"
}
]
}
SUSE:Linux Enterprise Desktop 12 SP3 / openssl
Package
- Name
- openssl
- Purl
- purl:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3
SUSE:Linux Enterprise Server for SAP Applications 12 SP2 / openssl
Package
- Name
- openssl
- Purl
- purl:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.0.2j-60.39.1
Ecosystem specific
{
"binaries": [
{
"libopenssl-devel": "1.0.2j-60.39.1",
"openssl-doc": "1.0.2j-60.39.1",
"openssl": "1.0.2j-60.39.1",
"libopenssl1_0_0": "1.0.2j-60.39.1",
"libopenssl1_0_0-32bit": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac-32bit": "1.0.2j-60.39.1"
}
]
}
SUSE:Linux Enterprise Software Development Kit 12 SP3 / openssl
Package
- Name
- openssl
- Purl
- purl:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3
SUSE:Linux Enterprise Server 12 SP2-LTSS / openssl
Package
- Name
- openssl
- Purl
- purl:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.0.2j-60.39.1
Ecosystem specific
{
"binaries": [
{
"libopenssl-devel": "1.0.2j-60.39.1",
"openssl-doc": "1.0.2j-60.39.1",
"openssl": "1.0.2j-60.39.1",
"libopenssl1_0_0": "1.0.2j-60.39.1",
"libopenssl1_0_0-32bit": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac-32bit": "1.0.2j-60.39.1"
}
]
}
SUSE:Linux Enterprise Server 12 SP3 / openssl
Package
- Name
- openssl
- Purl
- purl:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.0.2j-60.39.1
Ecosystem specific
{
"binaries": [
{
"libopenssl-devel": "1.0.2j-60.39.1",
"openssl-doc": "1.0.2j-60.39.1",
"openssl": "1.0.2j-60.39.1",
"libopenssl1_0_0": "1.0.2j-60.39.1",
"libopenssl1_0_0-32bit": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac-32bit": "1.0.2j-60.39.1"
}
]
}
SUSE:Linux Enterprise Server for SAP Applications 12 SP3 / openssl
Package
- Name
- openssl
- Purl
- purl:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.0.2j-60.39.1
Ecosystem specific
{
"binaries": [
{
"libopenssl-devel": "1.0.2j-60.39.1",
"openssl-doc": "1.0.2j-60.39.1",
"openssl": "1.0.2j-60.39.1",
"libopenssl1_0_0": "1.0.2j-60.39.1",
"libopenssl1_0_0-32bit": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac-32bit": "1.0.2j-60.39.1"
}
]
}
SUSE:Enterprise Storage 4 / openssl
Package
- Name
- openssl
- Purl
- purl:rpm/suse/openssl&distro=SUSE%20Enterprise%20Storage%204
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.0.2j-60.39.1
Ecosystem specific
{
"binaries": [
{
"libopenssl-devel": "1.0.2j-60.39.1",
"openssl-doc": "1.0.2j-60.39.1",
"openssl": "1.0.2j-60.39.1",
"libopenssl1_0_0": "1.0.2j-60.39.1",
"libopenssl1_0_0-32bit": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac": "1.0.2j-60.39.1",
"libopenssl1_0_0-hmac-32bit": "1.0.2j-60.39.1"
}
]
}