{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2024-0727: Fix NULL pointer dereference in processing PKCS12 files,\n preventing potential DoS attack\n- CVE-2023-6129: Fix POLY1305 MAC implementation bug that corrupts internal\n state on PowerPC CPUs with vector instructions\n- CVE-2023-5678: Fix issue with excessively long X9.42 DH keys or parameters\n causing long delays and potential DoS by adding checks in DH_generate_key()\n and DH_check_pub_key() functions\n- CVE-2023-3817: Fix excessively long DH key or parameters check causing\n potential Denial of Service by preventing unnecessary checks if q is larger\n than p\n- CVE-2023-3446: Fix issue of excessively long DH keys or parameters causing\n slow checks, leading to potential Denial of Service. Added additional checks\n to prevent DoS vulnerability in DH_check(), DH_check_ex(), and\n EVP_PKEY_param_check() functions\n- CVE-2023-2975: Fix issue with AES-SIV cipher ignoring empty associated data\n entries by performing authentication operation for empty data during\n EVP_EncryptUpdate()", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413", "url": "https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2024/clsa-2024_1718291413.json" } ], "tracking": { "current_release_date": "2026-05-12T21:45:11Z", "generator": { "date": "2026-05-12T21:45:11Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2024:1718291413", "initial_release_date": "2024-06-13T11:10:16Z", "revision_history": [ { "date": "2024-06-13T11:10:16Z", "number": "1", "summary": "Initial version" }, { "date": "2026-05-12T21:45:11Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "openssl: Fix of 6 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.2", "product": { "name": "AlmaLinux 9.2", "product_id": "AlmaLinux-9.2", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.2:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "product": { "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "product_id": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-libs@3.0.7-17.el9_2.tuxcare.els2?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "product": { "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "product_id": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-devel@3.0.7-17.el9_2.tuxcare.els2?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "product": { "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "product_id": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-libs@3.0.7-17.el9_2.tuxcare.els1?arch=i686&epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "product": { "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "product_id": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-devel@3.0.7-17.el9_2.tuxcare.els1?arch=i686&epoch=1" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product": { "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product_id": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-libs@3.0.7-17.el9_2.tuxcare.els2?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product": { "name": "openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product_id": "openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl@3.0.7-17.el9_2.tuxcare.els2?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product": { "name": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product_id": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-perl@3.0.7-17.el9_2.tuxcare.els2?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product": { "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product_id": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-devel@3.0.7-17.el9_2.tuxcare.els2?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product": { "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product_id": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-libs@3.0.7-17.el9_2.tuxcare.els1?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product": { "name": "openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product_id": "openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl@3.0.7-17.el9_2.tuxcare.els1?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product": { "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product_id": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-devel@3.0.7-17.el9_2.tuxcare.els1?arch=x86_64&epoch=1" } } }, { "category": "product_version", "name": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product": { "name": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product_id": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/openssl-perl@3.0.7-17.el9_2.tuxcare.els1?arch=x86_64&epoch=1" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686" }, "product_reference": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" }, "product_reference": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" }, "product_reference": "openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" }, "product_reference": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686" }, "product_reference": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" }, "product_reference": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686" }, "product_reference": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" }, "product_reference": "openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" }, "product_reference": "openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" }, "product_reference": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686" }, "product_reference": "openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" }, "product_reference": "openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-2975", "cwe": { "id": "CWE-354", "name": "Improper Validation of Integrity Check Value" }, "notes": [ { "category": "description", "text": "Issue summary: The AES-SIV cipher implementation contains a bug that causes\nit to ignore empty associated data entries which are unauthenticated as\na consequence.\n\nImpact summary: Applications that use the AES-SIV algorithm and want to\nauthenticate empty data entries as associated data can be misled by removing,\nadding or reordering such empty entries as these are ignored by the OpenSSL\nimplementation. We are currently unaware of any such applications.\n\nThe AES-SIV algorithm allows for authentication of multiple associated\ndata entries along with the encryption. To authenticate empty data the\napplication has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with\nNULL pointer as the output buffer and 0 as the input buffer length.\nThe AES-SIV implementation in OpenSSL just returns success for such a call\ninstead of performing the associated data authentication operation.\nThe empty data thus will not be authenticated.\n\nAs this issue does not affect non-empty associated data authentication and\nwe expect it to be rare for an application to use empty associated data\nentries this is qualified as Low severity issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "known_affected": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-2975" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20230714.txt", "url": "https://www.openssl.org/news/secadv/20230714.txt" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/07/15/1", "url": "http://www.openwall.com/lists/oss-security/2023/07/15/1" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/07/19/5", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202402-08", "url": "https://security.gentoo.org/glsa/202402-08" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20230725-0004/", "url": "https://security.netapp.com/advisory/ntap-20230725-0004/" } ], "release_date": "2023-07-14T12:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2024-06-13T11:10:16Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413" }, { "category": "none_available", "date": "2023-07-14T12:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2023-3446", "cwe": { "id": "CWE-606", "name": "Unchecked Input for Loop Condition" }, "notes": [ { "category": "description", "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. One of those\nchecks confirms that the modulus ('p' parameter) is not too large. Trying to use\na very large modulus is slow and OpenSSL will not normally use a modulus which\nis over 10,000 bits in length.\n\nHowever the DH_check() function checks numerous aspects of the key or parameters\nthat have been supplied. Some of those checks use the supplied modulus value\neven if it has already been found to be too large.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulernable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the '-check' option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "known_affected": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-3446" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20230719.txt", "url": "https://www.openssl.org/news/secadv/20230719.txt" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/07/19/4", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/4" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/07/19/5", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/5" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/07/19/6", "url": "http://www.openwall.com/lists/oss-security/2023/07/19/6" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/07/31/1", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/05/16/1", "url": "http://www.openwall.com/lists/oss-security/2024/05/16/1" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202402-08", "url": "https://security.gentoo.org/glsa/202402-08" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20230803-0011/", "url": "https://security.netapp.com/advisory/ntap-20230803-0011/" } ], "release_date": "2023-07-19T12:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2024-06-13T11:10:16Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413" }, { "category": "none_available", "date": "2023-07-19T12:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2023-3817", "cwe": { "id": "CWE-606", "name": "Unchecked Input for Loop Condition" }, "notes": [ { "category": "description", "text": "Issue summary: Checking excessively long DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_check(), DH_check_ex()\nor EVP_PKEY_param_check() to check a DH key or DH parameters may experience long\ndelays. Where the key or parameters that are being checked have been obtained\nfrom an untrusted source this may lead to a Denial of Service.\n\nThe function DH_check() performs various checks on DH parameters. After fixing\nCVE-2023-3446 it was discovered that a large q parameter value can also trigger\nan overly long computation during some of these checks. A correct q value,\nif present, cannot be larger than the modulus p parameter, thus it is\nunnecessary to perform these checks if q is larger than p.\n\nAn application that calls DH_check() and supplies a key or parameters obtained\nfrom an untrusted source could be vulnerable to a Denial of Service attack.\n\nThe function DH_check() is itself called by a number of other OpenSSL functions.\nAn application calling any of those other functions may similarly be affected.\nThe other functions affected by this are DH_check_ex() and\nEVP_PKEY_param_check().\n\nAlso vulnerable are the OpenSSL dhparam and pkeyparam command line applications\nwhen using the \"-check\" option.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "known_affected": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-3817" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20230731.txt", "url": "https://www.openssl.org/news/secadv/20230731.txt" }, { "category": "external", "summary": "http://seclists.org/fulldisclosure/2023/Jul/43", "url": "http://seclists.org/fulldisclosure/2023/Jul/43" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/07/31/1", "url": "http://www.openwall.com/lists/oss-security/2023/07/31/1" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/09/22/11", "url": "http://www.openwall.com/lists/oss-security/2023/09/22/11" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/09/22/9", "url": "http://www.openwall.com/lists/oss-security/2023/09/22/9" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2023/11/06/2", "url": "http://www.openwall.com/lists/oss-security/2023/11/06/2" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html", "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202402-08", "url": "https://security.gentoo.org/glsa/202402-08" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20230818-0014/", "url": "https://security.netapp.com/advisory/ntap-20230818-0014/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20231027-0008/", "url": "https://security.netapp.com/advisory/ntap-20231027-0008/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240621-0006/", "url": "https://security.netapp.com/advisory/ntap-20240621-0006/" } ], "release_date": "2023-07-31T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2024-06-13T11:10:16Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413" }, { "category": "none_available", "date": "2023-07-31T16:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2024-0727", "cwe": { "id": "CWE-476", "name": "NULL Pointer Dereference" }, "notes": [ { "category": "description", "text": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "known_affected": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-0727" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2", "url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a", "url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c", "url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c" }, { "category": "external", "summary": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8", "url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8" }, { "category": "external", "summary": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539", "url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20240125.txt", "url": "https://www.openssl.org/news/secadv/20240125.txt" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/03/11/1", "url": "http://www.openwall.com/lists/oss-security/2024/03/11/1" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html", "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240208-0006/", "url": "https://security.netapp.com/advisory/ntap-20240208-0006/" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html" } ], "release_date": "2024-01-26T09:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2024-06-13T11:10:16Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413" }, { "category": "none_available", "date": "2024-01-26T09:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2023-6129", "cwe": { "id": "CWE-440", "name": "Expected Behavior Violation" }, "notes": [ { "category": "description", "text": "Issue summary: The POLY1305 MAC (message authentication code) implementation\ncontains a bug that might corrupt the internal state of applications running\non PowerPC CPU based platforms if the CPU provides vector instructions.\n\nImpact summary: If an attacker can influence whether the POLY1305 MAC\nalgorithm is used, the application state might be corrupted with various\napplication dependent consequences.\n\nThe POLY1305 MAC (message authentication code) implementation in OpenSSL for\nPowerPC CPUs restores the contents of vector registers in a different order\nthan they are saved. Thus the contents of some of these vector registers\nare corrupted when returning to the caller. The vulnerable code is used only\non newer PowerPC processors supporting the PowerISA 2.07 instructions.\n\nThe consequences of this kind of internal application state corruption can\nbe various - from no consequences, if the calling application does not\ndepend on the contents of non-volatile XMM registers at all, to the worst\nconsequences, where the attacker could get complete control of the application\nprocess. However unless the compiler uses the vector registers for storing\npointers, the most likely consequence, if any, would be an incorrect result\nof some application dependent calculations or a crash leading to a denial of\nservice.\n\nThe POLY1305 MAC algorithm is most frequently used as part of the\nCHACHA20-POLY1305 AEAD (authenticated encryption with associated data)\nalgorithm. The most common usage of this AEAD cipher is with TLS protocol\nversions 1.2 and 1.3. If this cipher is enabled on the server a malicious\nclient can influence whether this AEAD cipher is used. This implies that\nTLS server applications using OpenSSL can be potentially impacted. However\nwe are currently not aware of any concrete application that would be affected\nby this issue therefore we consider this a Low severity security issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "known_affected": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-6129" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/050d26383d4e264966fb83428e72d5d48f402d35", "url": "https://github.com/openssl/openssl/commit/050d26383d4e264966fb83428e72d5d48f402d35" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/5b139f95c9a47a55a0c54100f3837b1eee942b04", "url": "https://github.com/openssl/openssl/commit/5b139f95c9a47a55a0c54100f3837b1eee942b04" }, { "category": "external", "summary": "https://github.com/openssl/openssl/commit/f3fc5808fe9ff74042d639839610d03b8fdcc015", "url": "https://github.com/openssl/openssl/commit/f3fc5808fe9ff74042d639839610d03b8fdcc015" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20240109.txt", "url": "https://www.openssl.org/news/secadv/20240109.txt" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/03/11/1", "url": "http://www.openwall.com/lists/oss-security/2024/03/11/1" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240216-0009/", "url": "https://security.netapp.com/advisory/ntap-20240216-0009/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240426-0008/", "url": "https://security.netapp.com/advisory/ntap-20240426-0008/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240426-0013/", "url": "https://security.netapp.com/advisory/ntap-20240426-0013/" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240503-0011/", "url": "https://security.netapp.com/advisory/ntap-20240503-0011/" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html" } ], "release_date": "2024-01-09T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2024-06-13T11:10:16Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413" }, { "category": "none_available", "date": "2024-01-09T17:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2023-5678", "cwe": { "id": "CWE-606", "name": "Unchecked Input for Loop Condition" }, "notes": [ { "category": "description", "text": "Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays. Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions. An application calling any of those other\nfunctions may similarly be affected. The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "known_affected": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-5678" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=34efaef6c103d636ab507a0cc34dca4d3aecc055" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=710fee740904b6290fef0dd5536fbcedbc38ff0c" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db925ae2e65d0d925adef429afc37f75bd1c2017" }, { "category": "external", "summary": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6", "url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=ddeb4b6c6d527e54ce9a99cba785c0f7776e54b6" }, { "category": "external", "summary": "https://www.openssl.org/news/secadv/20231106.txt", "url": "https://www.openssl.org/news/secadv/20231106.txt" }, { "category": "external", "summary": "http://www.openwall.com/lists/oss-security/2024/03/11/1", "url": "http://www.openwall.com/lists/oss-security/2024/03/11/1" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html", "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html" }, { "category": "external", "summary": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html", "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20231130-0010/", "url": "https://security.netapp.com/advisory/ntap-20231130-0010/" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-093430.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-093430.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-128433.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-128433.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-277137.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-331112.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-341067.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-341067.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-556635.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-556635.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-613116.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-769027.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-794697.html" }, { "category": "external", "summary": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html", "url": "https://cert-portal.siemens.com/productcert/html/ssa-915275.html" } ], "release_date": "2023-11-06T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2024-06-13T11:10:16Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2024:1718291413" }, { "category": "none_available", "date": "2023-11-06T16:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els1.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els1.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AlmaLinux-9.2:openssl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-devel-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.i686", "AlmaLinux-9.2:openssl-libs-1:3.0.7-17.el9_2.tuxcare.els2.x86_64", "AlmaLinux-9.2:openssl-perl-1:3.0.7-17.el9_2.tuxcare.els2.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }