suse-su-2015:0305-1
Vulnerability from csaf_suse
Published
2015-02-04 12:44
Modified
2015-02-04 12:44
Summary
Security update for compat-openssl098

Notes

Title of the patch
Security update for compat-openssl098
Description of the patch
The openssl 0.9.8j compatibility package was updated to fix several security vulnerabilities: CVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64. CVE-2014-3571: Fix crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record. CVE-2014-3572: Do not accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted. CVE-2014-8275: Fixed various certificate fingerprint issues CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites CVE-2015-0205: OpenSSL 0.9.8j is NOT vulnerable to CVE-2015-0205 as it doesn't support DH certificates and this typo prohibits skipping of certificate verify message for sign only certificates anyway. (This patch only fixes the wrong condition) This update also fixes regression caused by CVE-2014-0224.patch (bnc#892403)
Patchnames
SUSE-SLE-DESKTOP-12-2015-78,SUSE-SLE-Module-Legacy-12-2015-78
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for compat-openssl098",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThe openssl 0.9.8j compatibility package was updated to fix several security vulnerabilities:\n\nCVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect results\non some platforms, including x86_64.\n\nCVE-2014-3571: Fix crash in dtls1_get_record whilst in the listen state where\nyou get two separate reads performed - one for the header and\none for the body of the handshake record.\n\nCVE-2014-3572: Do not accept a handshake using an ephemeral ECDH ciphersuites\nwith the server key exchange message omitted.\n\nCVE-2014-8275: Fixed various certificate fingerprint issues\n\nCVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites\n\nCVE-2015-0205: OpenSSL 0.9.8j is NOT vulnerable to CVE-2015-0205 as it doesn\u0027t\nsupport DH certificates and this typo prohibits skipping of\ncertificate verify message for sign only certificates anyway.\n(This patch only fixes the wrong condition)\n\nThis update also fixes regression caused by CVE-2014-0224.patch (bnc#892403)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-DESKTOP-12-2015-78,SUSE-SLE-Module-Legacy-12-2015-78",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_0305-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2015:0305-1",
        "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150305-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2015:0305-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2015-February/001232.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 892403",
        "url": "https://bugzilla.suse.com/892403"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912014",
        "url": "https://bugzilla.suse.com/912014"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912015",
        "url": "https://bugzilla.suse.com/912015"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912018",
        "url": "https://bugzilla.suse.com/912018"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912293",
        "url": "https://bugzilla.suse.com/912293"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912294",
        "url": "https://bugzilla.suse.com/912294"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912296",
        "url": "https://bugzilla.suse.com/912296"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-0224 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-0224/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3570 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3570/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3571 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3571/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3572 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3572/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-8275 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-8275/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-0204 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-0204/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-0205 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-0205/"
      }
    ],
    "title": "Security update for compat-openssl098",
    "tracking": {
      "current_release_date": "2015-02-04T12:44:14Z",
      "generator": {
        "date": "2015-02-04T12:44:14Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2015:0305-1",
      "initial_release_date": "2015-02-04T12:44:14Z",
      "revision_history": [
        {
          "date": "2015-02-04T12:44:14Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libopenssl0_9_8-0.9.8j-70.2.s390x",
                "product": {
                  "name": "libopenssl0_9_8-0.9.8j-70.2.s390x",
                  "product_id": "libopenssl0_9_8-0.9.8j-70.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
                "product": {
                  "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
                  "product_id": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libopenssl0_9_8-0.9.8j-70.2.x86_64",
                "product": {
                  "name": "libopenssl0_9_8-0.9.8j-70.2.x86_64",
                  "product_id": "libopenssl0_9_8-0.9.8j-70.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
                "product": {
                  "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
                  "product_id": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Desktop 12",
                "product": {
                  "name": "SUSE Linux Enterprise Desktop 12",
                  "product_id": "SUSE Linux Enterprise Desktop 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sled:12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Legacy 12",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Legacy 12",
                  "product_id": "SUSE Linux Enterprise Module for Legacy 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-legacy:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-0.9.8j-70.2.x86_64 as component of SUSE Linux Enterprise Desktop 12",
          "product_id": "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64"
        },
        "product_reference": "libopenssl0_9_8-0.9.8j-70.2.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64 as component of SUSE Linux Enterprise Desktop 12",
          "product_id": "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        },
        "product_reference": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-0.9.8j-70.2.s390x as component of SUSE Linux Enterprise Module for Legacy 12",
          "product_id": "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x"
        },
        "product_reference": "libopenssl0_9_8-0.9.8j-70.2.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-0.9.8j-70.2.x86_64 as component of SUSE Linux Enterprise Module for Legacy 12",
          "product_id": "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64"
        },
        "product_reference": "libopenssl0_9_8-0.9.8j-70.2.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x as component of SUSE Linux Enterprise Module for Legacy 12",
          "product_id": "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x"
        },
        "product_reference": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64 as component of SUSE Linux Enterprise Module for Legacy 12",
          "product_id": "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        },
        "product_reference": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-0224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-0224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the \"CCS Injection\" vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-0224",
          "url": "https://www.suse.com/security/cve/CVE-2014-0224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1146657 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/1146657"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 880891 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/880891"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 881743 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/881743"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 883126 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/883126"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 885777 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/885777"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 892403 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/892403"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901237 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/901237"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 903703 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/903703"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 905018 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/905018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 905106 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/905106"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 914447 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/914447"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915913 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/915913"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 916239 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/916239"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-0224"
    },
    {
      "cve": "CVE-2014-3570",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3570"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3570",
          "url": "https://www.suse.com/security/cve/CVE-2014-3570"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912296 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/912296"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937891 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/937891"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 944456 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/944456"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-3570"
    },
    {
      "cve": "CVE-2014-3571",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3571"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3571",
          "url": "https://www.suse.com/security/cve/CVE-2014-3571"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912294 for CVE-2014-3571",
          "url": "https://bugzilla.suse.com/912294"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2014-3571",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2014-3571",
          "url": "https://bugzilla.suse.com/927623"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-3571"
    },
    {
      "cve": "CVE-2014-3572",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3572"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3572",
          "url": "https://www.suse.com/security/cve/CVE-2014-3572"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912015 for CVE-2014-3572",
          "url": "https://bugzilla.suse.com/912015"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2014-3572",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2014-3572",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937891 for CVE-2014-3572",
          "url": "https://bugzilla.suse.com/937891"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-3572"
    },
    {
      "cve": "CVE-2014-8275",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-8275"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate\u0027s unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-8275",
          "url": "https://www.suse.com/security/cve/CVE-2014-8275"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912018 for CVE-2014-8275",
          "url": "https://bugzilla.suse.com/912018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2014-8275",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2014-8275",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937891 for CVE-2014-8275",
          "url": "https://bugzilla.suse.com/937891"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-8275"
    },
    {
      "cve": "CVE-2015-0204",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-0204"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the \"FREAK\" issue.  NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-0204",
          "url": "https://www.suse.com/security/cve/CVE-2015-0204"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912014 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/912014"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 920482 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/920482"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 920484 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/920484"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927591 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/927591"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 936787 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/936787"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 952088 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/952088"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2015-0204"
    },
    {
      "cve": "CVE-2015-0205",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-0205"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-0205",
          "url": "https://www.suse.com/security/cve/CVE-2015-0205"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912293 for CVE-2015-0205",
          "url": "https://bugzilla.suse.com/912293"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2015-0205",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2015-0205",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937891 for CVE-2015-0205",
          "url": "https://bugzilla.suse.com/937891"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-0205"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.