Security update for openssl-3 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:3107-1 Final 1 1 2024-09-03T15:01:25Z current 2024-09-03T15:01:25Z 2024-09-03T15:01:25Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl-3 This update for openssl-3 fixes the following issues: - CVE-2024-6119: Fixed denial of service in X.509 name checks (bsc#1229465) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-3107,SUSE-SLE-Micro-5.3-2024-3107,SUSE-SLE-Micro-5.4-2024-3107,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-3107,SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-3107,SUSE-SLE-Product-SLED-15-SP4-LTSS-2024-3107,SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3107,SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3107,SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-3107,SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-3107 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20243107-1/ Link for SUSE-SU-2024:3107-1 https://lists.suse.com/pipermail/sle-updates/2024-September/036765.html E-Mail link for SUSE-SU-2024:3107-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1229465 SUSE Bug 1229465 https://www.suse.com/security/cve/CVE-2024-6119/ SUSE CVE CVE-2024-6119 page SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Server 4.3 libopenssl-3-devel-3.0.8-150400.4.63.1 libopenssl-3-devel-32bit-3.0.8-150400.4.63.1 libopenssl-3-devel-64bit-3.0.8-150400.4.63.1 libopenssl3-3.0.8-150400.4.63.1 libopenssl3-32bit-3.0.8-150400.4.63.1 libopenssl3-64bit-3.0.8-150400.4.63.1 openssl-3-3.0.8-150400.4.63.1 openssl-3-doc-3.0.8-150400.4.63.1 libopenssl-3-devel-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS libopenssl3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS openssl-3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS libopenssl-3-devel-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libopenssl3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS openssl-3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS libopenssl3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise Micro 5.3 libopenssl3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise Micro 5.4 libopenssl-3-devel-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libopenssl3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS openssl-3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise Server 15 SP4-LTSS libopenssl-3-devel-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libopenssl3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 openssl-3-3.0.8-150400.4.63.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 libopenssl-3-devel-3.0.8-150400.4.63.1 as a component of SUSE Manager Proxy 4.3 libopenssl3-3.0.8-150400.4.63.1 as a component of SUSE Manager Proxy 4.3 openssl-3-3.0.8-150400.4.63.1 as a component of SUSE Manager Proxy 4.3 libopenssl-3-devel-3.0.8-150400.4.63.1 as a component of SUSE Manager Server 4.3 libopenssl3-3.0.8-150400.4.63.1 as a component of SUSE Manager Server 4.3 openssl-3-3.0.8-150400.4.63.1 as a component of SUSE Manager Server 4.3 Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherName` subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program. Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address. TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue. CVE-2024-6119 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libopenssl-3-devel-3.0.8-150400.4.63.1 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:libopenssl3-3.0.8-150400.4.63.1 SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:openssl-3-3.0.8-150400.4.63.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libopenssl-3-devel-3.0.8-150400.4.63.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:libopenssl3-3.0.8-150400.4.63.1 SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:openssl-3-3.0.8-150400.4.63.1 SUSE Linux Enterprise Micro 5.3:libopenssl3-3.0.8-150400.4.63.1 SUSE Linux Enterprise Micro 5.4:libopenssl3-3.0.8-150400.4.63.1 SUSE Linux Enterprise Server 15 SP4-LTSS:libopenssl-3-devel-3.0.8-150400.4.63.1 SUSE Linux Enterprise Server 15 SP4-LTSS:libopenssl3-3.0.8-150400.4.63.1 SUSE Linux Enterprise Server 15 SP4-LTSS:openssl-3-3.0.8-150400.4.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4:libopenssl-3-devel-3.0.8-150400.4.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4:libopenssl3-3.0.8-150400.4.63.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4:openssl-3-3.0.8-150400.4.63.1 SUSE Manager Proxy 4.3:libopenssl-3-devel-3.0.8-150400.4.63.1 SUSE Manager Proxy 4.3:libopenssl3-3.0.8-150400.4.63.1 SUSE Manager Proxy 4.3:openssl-3-3.0.8-150400.4.63.1 SUSE Manager Server 4.3:libopenssl-3-devel-3.0.8-150400.4.63.1 SUSE Manager Server 4.3:libopenssl3-3.0.8-150400.4.63.1 SUSE Manager Server 4.3:openssl-3-3.0.8-150400.4.63.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20243107-1/ https://www.suse.com/security/cve/CVE-2024-6119.html CVE-2024-6119 https://bugzilla.suse.com/1229465 SUSE Bug 1229465