Security update for openssl SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:0803-1 Final 1 1 2019-03-29T12:14:45Z current 2019-03-29T12:14:45Z 2019-03-29T12:14:45Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl This update for openssl fixes the following issues: Security issues fixed: - The 9 Lives of Bleichenbacher's CAT: Cache Attacks on TLS Implementations (bsc#1117951) - CVE-2019-1559: Fixed OpenSSL 0-byte Record Padding Oracle which under certain circumstances a TLS server can be forced to respond differently to a client and lead to the decryption of the data (bsc#1127080). Other issues addressed: - Fixed IV handling in SHAEXT paths: aes/asm/aesni-sha*-x86_64.pl (bsc#1113975). - Set TLS version to 0 in msg_callback for record messages to avoid confusing applications (bsc#1100078). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container caasp/v4/nginx-ingress-controller:beta1-2019-803,Container suse/sles12sp3:latest-2019-803,SUSE-2019-803,SUSE-OpenStack-Cloud-7-2019-803,SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2019-803,SUSE-SLE-DESKTOP-12-SP3-2019-803,SUSE-SLE-SAP-12-SP2-2019-803,SUSE-SLE-SDK-12-SP3-2019-803,SUSE-SLE-SERVER-12-SP2-2019-803,SUSE-SLE-SERVER-12-SP2-BCL-2019-803,SUSE-SLE-SERVER-12-SP3-2019-803,SUSE-Storage-4-2019-803 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20190803-1/ Link for SUSE-SU-2019:0803-1 https://lists.suse.com/pipermail/sle-security-updates/2019-March/005266.html E-Mail link for SUSE-SU-2019:0803-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1100078 SUSE Bug 1100078 https://bugzilla.suse.com/1113975 SUSE Bug 1113975 https://bugzilla.suse.com/1117951 SUSE Bug 1117951 https://bugzilla.suse.com/1127080 SUSE Bug 1127080 https://www.suse.com/security/cve/CVE-2019-1559/ SUSE CVE CVE-2019-1559 page Container caasp/v4/nginx-ingress-controller:beta1 Container suse/sles12sp3:latest SUSE Enterprise Storage 4 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP3 SUSE OpenStack Cloud 7 libopenssl1_0_0-1.0.2j-60.49.1 openssl-1.0.2j-60.49.1 libopenssl-devel-1.0.2j-60.49.1 libopenssl-devel-32bit-1.0.2j-60.49.1 libopenssl-devel-64bit-1.0.2j-60.49.1 libopenssl1_0_0-32bit-1.0.2j-60.49.1 libopenssl1_0_0-64bit-1.0.2j-60.49.1 libopenssl1_0_0-hmac-1.0.2j-60.49.1 libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 libopenssl1_0_0-hmac-64bit-1.0.2j-60.49.1 openssl-cavs-1.0.2j-60.49.1 openssl-doc-1.0.2j-60.49.1 libopenssl1_0_0-1.0.2j-60.49.1 as a component of Container caasp/v4/nginx-ingress-controller:beta1 openssl-1.0.2j-60.49.1 as a component of Container caasp/v4/nginx-ingress-controller:beta1 libopenssl1_0_0-1.0.2j-60.49.1 as a component of Container suse/sles12sp3:latest openssl-1.0.2j-60.49.1 as a component of Container suse/sles12sp3:latest libopenssl-devel-1.0.2j-60.49.1 as a component of SUSE Enterprise Storage 4 libopenssl1_0_0-1.0.2j-60.49.1 as a component of SUSE Enterprise Storage 4 libopenssl1_0_0-32bit-1.0.2j-60.49.1 as a component of SUSE Enterprise Storage 4 libopenssl1_0_0-hmac-1.0.2j-60.49.1 as a component of SUSE Enterprise Storage 4 libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 as a component of SUSE Enterprise Storage 4 openssl-1.0.2j-60.49.1 as a component of SUSE Enterprise Storage 4 openssl-doc-1.0.2j-60.49.1 as a component of SUSE Enterprise Storage 4 libopenssl-devel-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libopenssl1_0_0-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libopenssl1_0_0-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 openssl-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Desktop 12 SP3 libopenssl-devel-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libopenssl1_0_0-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libopenssl1_0_0-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libopenssl1_0_0-hmac-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL openssl-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL openssl-doc-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL libopenssl-devel-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libopenssl1_0_0-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libopenssl1_0_0-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libopenssl1_0_0-hmac-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS openssl-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS openssl-doc-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP2-LTSS libopenssl-devel-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-hmac-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP3 openssl-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP3 openssl-doc-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server 12 SP3 libopenssl-devel-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl1_0_0-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl1_0_0-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl1_0_0-hmac-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 openssl-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 openssl-doc-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 libopenssl-devel-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl1_0_0-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl1_0_0-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl1_0_0-hmac-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 openssl-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 openssl-doc-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 libopenssl-devel-1.0.2j-60.49.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 libopenssl-devel-1.0.2j-60.49.1 as a component of SUSE OpenStack Cloud 7 libopenssl1_0_0-1.0.2j-60.49.1 as a component of SUSE OpenStack Cloud 7 libopenssl1_0_0-32bit-1.0.2j-60.49.1 as a component of SUSE OpenStack Cloud 7 libopenssl1_0_0-hmac-1.0.2j-60.49.1 as a component of SUSE OpenStack Cloud 7 libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 as a component of SUSE OpenStack Cloud 7 openssl-1.0.2j-60.49.1 as a component of SUSE OpenStack Cloud 7 openssl-doc-1.0.2j-60.49.1 as a component of SUSE OpenStack Cloud 7 If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q). CVE-2019-1559 Container caasp/v4/nginx-ingress-controller:beta1:libopenssl1_0_0-1.0.2j-60.49.1 Container caasp/v4/nginx-ingress-controller:beta1:openssl-1.0.2j-60.49.1 Container suse/sles12sp3:latest:libopenssl1_0_0-1.0.2j-60.49.1 Container suse/sles12sp3:latest:openssl-1.0.2j-60.49.1 SUSE Enterprise Storage 4:libopenssl-devel-1.0.2j-60.49.1 SUSE Enterprise Storage 4:libopenssl1_0_0-1.0.2j-60.49.1 SUSE Enterprise Storage 4:libopenssl1_0_0-32bit-1.0.2j-60.49.1 SUSE Enterprise Storage 4:libopenssl1_0_0-hmac-1.0.2j-60.49.1 SUSE Enterprise Storage 4:libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 SUSE Enterprise Storage 4:openssl-1.0.2j-60.49.1 SUSE Enterprise Storage 4:openssl-doc-1.0.2j-60.49.1 SUSE Linux Enterprise Desktop 12 SP3:libopenssl-devel-1.0.2j-60.49.1 SUSE Linux Enterprise Desktop 12 SP3:libopenssl1_0_0-1.0.2j-60.49.1 SUSE Linux Enterprise Desktop 12 SP3:libopenssl1_0_0-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Desktop 12 SP3:openssl-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-BCL:libopenssl-devel-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-BCL:libopenssl1_0_0-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-BCL:libopenssl1_0_0-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-BCL:libopenssl1_0_0-hmac-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-BCL:libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-BCL:openssl-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-BCL:openssl-doc-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libopenssl-devel-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libopenssl1_0_0-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libopenssl1_0_0-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libopenssl1_0_0-hmac-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-LTSS:libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-LTSS:openssl-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP2-LTSS:openssl-doc-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP3:libopenssl-devel-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-hmac-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP3:libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP3:openssl-1.0.2j-60.49.1 SUSE Linux Enterprise Server 12 SP3:openssl-doc-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl-devel-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl1_0_0-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl1_0_0-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl1_0_0-hmac-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:openssl-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:openssl-doc-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl-devel-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl1_0_0-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl1_0_0-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl1_0_0-hmac-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openssl-1.0.2j-60.49.1 SUSE Linux Enterprise Server for SAP Applications 12 SP3:openssl-doc-1.0.2j-60.49.1 SUSE Linux Enterprise Software Development Kit 12 SP3:libopenssl-devel-1.0.2j-60.49.1 SUSE OpenStack Cloud 7:libopenssl-devel-1.0.2j-60.49.1 SUSE OpenStack Cloud 7:libopenssl1_0_0-1.0.2j-60.49.1 SUSE OpenStack Cloud 7:libopenssl1_0_0-32bit-1.0.2j-60.49.1 SUSE OpenStack Cloud 7:libopenssl1_0_0-hmac-1.0.2j-60.49.1 SUSE OpenStack Cloud 7:libopenssl1_0_0-hmac-32bit-1.0.2j-60.49.1 SUSE OpenStack Cloud 7:openssl-1.0.2j-60.49.1 SUSE OpenStack Cloud 7:openssl-doc-1.0.2j-60.49.1 low 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20190803-1/ https://www.suse.com/security/cve/CVE-2019-1559.html CVE-2019-1559 https://bugzilla.suse.com/1127080 SUSE Bug 1127080 https://bugzilla.suse.com/1130039 SUSE Bug 1130039 https://bugzilla.suse.com/1141798 SUSE Bug 1141798