< back to search

shield Security update for openssl
SUSE-SLE-SERVER-12-2015-52

OpenSSL was updated to fix security issues and also provide FIPS compliance. Security issues fixed: CVE-2014-3570: Bignum squaring (BN_sqr) may have produced incorrect results on some platforms, including x86_64. CVE-2014-3571: Fixed crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record. CVE-2014-3572: No longer accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted. CVE-2014-8275: Fixed various certificate fingerprint issues. CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites. CVE-2015-0205: Fix to prevent use of DH client certificates without sending certificate verify message. CVE-2015-0206: A memory leak could have occured in dtls1_buffer_record. Bugfixes: - Do not advertise curves we don't support (bsc#906878) FIPS changes: - Make RSA2 key generation FIPS 186-4 compliant (bsc#901902) - X9.31 rand method is not allowed in FIPS mode. - Do not allow dynamic ENGINEs loading in FIPS mode. - Added a locking hack which prevents hangs in FIPS mode (bsc#895129) - In non-FIPS RSA key generation, mirror the maximum and minimum limiters from FIPS rsa generation to meet Common Criteria and BSI TR requirements on minimum and maximum distances between p and q. (bsc#908362) - Do constant reseeding from /dev/urandom; for every random byte pulled, seed with one byte from /dev/urandom, also change RAND_poll to pull the full state size of the SSLEAY DRBG to fulfil Common Criteria requirements. (bsc#908372) FIPS mode can be enabled by either using the environment variable OPENSSL_FORCE_FIPS_MODE=1 or supplying the "fips=1" parameter on the kernel boot commandline.

cloud_download Downloads

SUSE Linux Enterprise Server for SAP Applications 12 x86_64
  • Packages
    libopenssl1_0_0
    Secure Sockets and Transport Layer Security
    1.0.1i-17.1 lock rpm
    libopenssl1_0_0-32bit
    Secure Sockets and Transport Layer Security
    1.0.1i-17.1 lock rpm
    libopenssl1_0_0-hmac
    HMAC files for FIPS-140-2 integrity checking of the openssl shared libraries
    1.0.1i-17.1 lock rpm
    libopenssl1_0_0-hmac-32bit
    HMAC files for FIPS-140-2 integrity checking of the openssl shared libraries
    1.0.1i-17.1 lock rpm
    openssl
    Secure Sockets and Transport Layer Security
    1.0.1i-17.1 lock rpm lock src
    openssl-doc
    Additional Package Documentation
    1.0.1i-17.1 lock rpm
SUSE Linux Enterprise Server 12 s390x
  • Packages
    libopenssl1_0_0
    Secure Sockets and Transport Layer Security
    1.0.1i-17.1 lock rpm
    libopenssl1_0_0-32bit
    Secure Sockets and Transport Layer Security
    1.0.1i-17.1 lock rpm
    libopenssl1_0_0-hmac
    HMAC files for FIPS-140-2 integrity checking of the openssl shared libraries
    1.0.1i-17.1 lock rpm
    libopenssl1_0_0-hmac-32bit
    HMAC files for FIPS-140-2 integrity checking of the openssl shared libraries
    1.0.1i-17.1 lock rpm
    openssl
    Secure Sockets and Transport Layer Security
    1.0.1i-17.1 lock rpm lock src
    openssl-doc
    Additional Package Documentation
    1.0.1i-17.1 lock rpm
SUSE Linux Enterprise Server 12 ppc64le
  • Packages
    libopenssl1_0_0
    Secure Sockets and Transport Layer Security
    1.0.1i-17.1 lock rpm
    libopenssl1_0_0-hmac
    HMAC files for FIPS-140-2 integrity checking of the openssl shared libraries
    1.0.1i-17.1 lock rpm
    openssl
    Secure Sockets and Transport Layer Security
    1.0.1i-17.1 lock rpm lock src
    openssl-doc
    Additional Package Documentation
    1.0.1i-17.1 lock rpm