-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.0172
             SUSE Security Update: Security update for openssl
                              17 January 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           openssl
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated
                   Access Privileged Data          -- Remote/Unauthenticated
                   Denial of Service               -- Remote/Unauthenticated
                   Provide Misleading Information  -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-3735 CVE-2017-3731 CVE-2016-8610
                   CVE-2016-7056 CVE-2016-2108 

Reference:         ASB-2017.0219
                   ASB-2017.0218
                   ASB-2017.0209
                   ASB-2017.0202
                   ESB-2016.1090
                   ESB-2016.1079
                   ESB-2016.1077
                   ESB-2016.1076

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2018/suse-su-20180112-1/

- --------------------------BEGIN INCLUDED TEXT--------------------

   SUSE Security Update: Security update for openssl
______________________________________________________________________________

Announcement ID:    SUSE-SU-2018:0112-1
Rating:             important
References:         #1000677 #1001502 #1001912 #1004499 #1005878 
                    #1019334 #1021641 #1022085 #1022271 #1027908 
                    #1032261 #1055825 #1056058 #1065363 #990592 
                    
Cross-References:   CVE-2016-2108 CVE-2016-7056 CVE-2016-8610
                    CVE-2017-3731 CVE-2017-3735
Affected Products:
                    SUSE Linux Enterprise Server 12-LTSS
______________________________________________________________________________

   An update that solves 5 vulnerabilities and has 10 fixes is
   now available.

Description:

   This update for openssl fixes the following issues:

   Security issues fixed:

   - CVE-2016-7056: ECSDA P-256 timing attack key recovery (bsc#1019334)
   - CVE-2017-3731: Truncated packet could crash via OOB read (bsc#1022085)
   - CVE-2016-8610: remote denial of service in SSL alert handling
     (bsc#1005878)
   - CVE-2017-3735: Malformed X.509 IPAdressFamily could cause OOB read
     (bsc#1056058)

   Bug fixes:

   - support alternate root ca chains (bsc#1032261)
   - X509_get_default_cert_file() returns an incorrect path (bsc#1022271)
   - Segmentation fault in 'openssl speed' when engine library file cannot be
     found (bsc#1000677)
   - adjust DEFAULT_SUSE to meet 1.0.2 and current state (bsc#1027908)
   - Missing important ciphers in openssl 1.0.1i-47.1 on SLES12 SP1
     (bsc#990592)
   - out of bounds read+crash in DES_fcrypt (bsc#1065363)
   - tracker bug for January 26th 2017 release (bsc#1021641)
   - patch for CVE-2016-2108 fails negative zero exploit (bsc#1001502)
   - Birthday attacks on 64-bit block ciphers aka triple-des (SWEET32)
     (bsc#1001912)
   - Include additional patch for CVE-2016-2108 (bsc#1004499)
   - openssl DEFAULT_SUSE cipher list is missing ECDHE-ECDSA ciphers
     (bsc#1055825)


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Server 12-LTSS:

      zypper in -t patch SUSE-SLE-SERVER-12-2018-79=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64):

      libopenssl1_0_0-1.0.1i-27.28.1
      libopenssl1_0_0-debuginfo-1.0.1i-27.28.1
      libopenssl1_0_0-hmac-1.0.1i-27.28.1
      openssl-1.0.1i-27.28.1
      openssl-debuginfo-1.0.1i-27.28.1
      openssl-debugsource-1.0.1i-27.28.1

   - SUSE Linux Enterprise Server 12-LTSS (s390x x86_64):

      libopenssl1_0_0-32bit-1.0.1i-27.28.1
      libopenssl1_0_0-debuginfo-32bit-1.0.1i-27.28.1
      libopenssl1_0_0-hmac-32bit-1.0.1i-27.28.1

   - SUSE Linux Enterprise Server 12-LTSS (noarch):

      openssl-doc-1.0.1i-27.28.1


References:

   https://www.suse.com/security/cve/CVE-2016-2108.html
   https://www.suse.com/security/cve/CVE-2016-7056.html
   https://www.suse.com/security/cve/CVE-2016-8610.html
   https://www.suse.com/security/cve/CVE-2017-3731.html
   https://www.suse.com/security/cve/CVE-2017-3735.html
   https://bugzilla.suse.com/1000677
   https://bugzilla.suse.com/1001502
   https://bugzilla.suse.com/1001912
   https://bugzilla.suse.com/1004499
   https://bugzilla.suse.com/1005878
   https://bugzilla.suse.com/1019334
   https://bugzilla.suse.com/1021641
   https://bugzilla.suse.com/1022085
   https://bugzilla.suse.com/1022271
   https://bugzilla.suse.com/1027908
   https://bugzilla.suse.com/1032261
   https://bugzilla.suse.com/1055825
   https://bugzilla.suse.com/1056058
   https://bugzilla.suse.com/1065363
   https://bugzilla.suse.com/990592

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWl6XwIx+lLeg9Ub1AQgTLRAAj1ObiX16llKt2L2HFIEQwl7tsQqnmT0J
DmyfyofZreS5D0fdBVTulOPyqOLOTArqTmNQMyTEsIyaJsq/n3lc5ee3xN66myas
CPS2oDTR+/37nNS9QoUobNN5w67+tcmcULMmT9tni8XVqE7qIyEoBJwXk7czI+F1
lsB9uJn+x0u/nCAPe2Yy1wr0imFllAMo3sr78xxuFb4fdd8ZwM53OX+PUbUYIlFd
SMmALJntBFjA5yRXP+S+Alx7SmkbvmxN4M+1y7f/vZWuvl01oVMzAyNbc+g+11+T
H5r4H9E9It/HUVAfrJ8YaSOsM8z8eOD9NXtFU6jwjbf+TEefUuA+JLiJN78TlBSI
p1HCyQJVKDR6eqnGScKOU91RRGU/KCx4tUz61k8Kk3ZIGjCErVQzOtVZMsMWYCW9
yUGOOUNZf1/ucGMNA2266/2QxhpvUiSZt0ACagw/9P9yI56GJmx0J+h9akaT96CH
YcutiZtmm6rdj+TBXEo/k36dvIoMqtRxYkMDVoJJELhI4rC/9QoJES08eg+lyp2S
8y/8RPqWDfdnnbNdQlc3WI6HL0VsFu35qJRBuD8/oAxeh/RF6h1KOFksyiQzsmYk
o+b4yVYm0AV+RbeLAP2ZHt/COaC7Sf8Jk8cCcl/xoacJQjKaOLicprNJ6yO3S5d4
8crkPaltCpA=
=lOWI
-----END PGP SIGNATURE-----