boringssl-devel-20200921-1.2 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:10660 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z boringssl-devel-20200921-1.2 on GA media These are all security issues fixed in the boringssl-devel-20200921-1.2 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-10660 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:10660 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2019-1551/ SUSE CVE CVE-2019-1551 page openSUSE Tumbleweed boringssl-devel-20200921-1.2 boringssl-source-20200921-1.2 libboringssl1-20200921-1.2 boringssl-devel-20200921-1.2 as a component of openSUSE Tumbleweed boringssl-source-20200921-1.2 as a component of openSUSE Tumbleweed libboringssl1-20200921-1.2 as a component of openSUSE Tumbleweed There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t). CVE-2019-1551 openSUSE Tumbleweed:boringssl-devel-20200921-1.2 openSUSE Tumbleweed:boringssl-source-20200921-1.2 openSUSE Tumbleweed:libboringssl1-20200921-1.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1551.html CVE-2019-1551 https://bugzilla.suse.com/1158809 SUSE Bug 1158809 https://bugzilla.suse.com/1205621 SUSE Bug 1205621