libopenssl-3-devel-3.1.4-13.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14317-1 Final 1 1 2024-09-05T00:00:00Z current 2024-09-05T00:00:00Z 2024-09-05T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z libopenssl-3-devel-3.1.4-13.1 on GA media These are all security issues fixed in the libopenssl-3-devel-3.1.4-13.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14317 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/72HQXYTYRYSUESQTFLZVCSPGKFEDEBGR/ E-Mail link for openSUSE-SU-2024:14317-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-6119/ SUSE CVE CVE-2024-6119 page openSUSE Tumbleweed libopenssl-3-devel-3.1.4-13.1 libopenssl-3-devel-32bit-3.1.4-13.1 libopenssl-3-fips-provider-3.1.4-13.1 libopenssl-3-fips-provider-32bit-3.1.4-13.1 libopenssl-3-fips-provider-x86-64-v3-3.1.4-13.1 libopenssl3-3.1.4-13.1 libopenssl3-32bit-3.1.4-13.1 libopenssl3-x86-64-v3-3.1.4-13.1 openssl-3-3.1.4-13.1 openssl-3-doc-3.1.4-13.1 libopenssl-3-devel-3.1.4-13.1 as a component of openSUSE Tumbleweed libopenssl-3-devel-32bit-3.1.4-13.1 as a component of openSUSE Tumbleweed libopenssl-3-fips-provider-3.1.4-13.1 as a component of openSUSE Tumbleweed libopenssl-3-fips-provider-32bit-3.1.4-13.1 as a component of openSUSE Tumbleweed libopenssl-3-fips-provider-x86-64-v3-3.1.4-13.1 as a component of openSUSE Tumbleweed libopenssl3-3.1.4-13.1 as a component of openSUSE Tumbleweed libopenssl3-32bit-3.1.4-13.1 as a component of openSUSE Tumbleweed libopenssl3-x86-64-v3-3.1.4-13.1 as a component of openSUSE Tumbleweed openssl-3-3.1.4-13.1 as a component of openSUSE Tumbleweed openssl-3-doc-3.1.4-13.1 as a component of openSUSE Tumbleweed Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherName` subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program. Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address. TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. CVE-2024-6119 openSUSE Tumbleweed:libopenssl-3-devel-3.1.4-13.1 openSUSE Tumbleweed:libopenssl-3-devel-32bit-3.1.4-13.1 openSUSE Tumbleweed:libopenssl-3-fips-provider-3.1.4-13.1 openSUSE Tumbleweed:libopenssl-3-fips-provider-32bit-3.1.4-13.1 openSUSE Tumbleweed:libopenssl-3-fips-provider-x86-64-v3-3.1.4-13.1 openSUSE Tumbleweed:libopenssl3-3.1.4-13.1 openSUSE Tumbleweed:libopenssl3-32bit-3.1.4-13.1 openSUSE Tumbleweed:libopenssl3-x86-64-v3-3.1.4-13.1 openSUSE Tumbleweed:openssl-3-3.1.4-13.1 openSUSE Tumbleweed:openssl-3-doc-3.1.4-13.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/72HQXYTYRYSUESQTFLZVCSPGKFEDEBGR/ https://www.suse.com/security/cve/CVE-2024-6119.html CVE-2024-6119 https://bugzilla.suse.com/1229465 SUSE Bug 1229465