SUSE-SU-2015:0305-1

Vulnerability from csaf_suse - Published: 2015-02-04 12:44 - Updated: 2015-02-04 12:44
Summary
Security update for compat-openssl098
Severity
Moderate
Notes
Title of the patch: Security update for compat-openssl098
Description of the patch: The openssl 0.9.8j compatibility package was updated to fix several security vulnerabilities: CVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect results on some platforms, including x86_64. CVE-2014-3571: Fix crash in dtls1_get_record whilst in the listen state where you get two separate reads performed - one for the header and one for the body of the handshake record. CVE-2014-3572: Do not accept a handshake using an ephemeral ECDH ciphersuites with the server key exchange message omitted. CVE-2014-8275: Fixed various certificate fingerprint issues CVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites CVE-2015-0205: OpenSSL 0.9.8j is NOT vulnerable to CVE-2015-0205 as it doesn't support DH certificates and this typo prohibits skipping of certificate verify message for sign only certificates anyway. (This patch only fixes the wrong condition) This update also fixes regression caused by CVE-2014-0224.patch (bnc#892403)
Patchnames: SUSE-SLE-DESKTOP-12-2015-78,SUSE-SLE-Module-Legacy-12-2015-78
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2014-0224
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2014-3570
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2014-3571
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2014-3572
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2014-8275
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2015-0204
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
CVE-2015-0205
Vendor Fix To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
References
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/s… self
https://www.suse.com/support/update/announcement/… self
https://lists.suse.com/pipermail/sle-security-upd… self
https://bugzilla.suse.com/892403 self
https://bugzilla.suse.com/912014 self
https://bugzilla.suse.com/912015 self
https://bugzilla.suse.com/912018 self
https://bugzilla.suse.com/912293 self
https://bugzilla.suse.com/912294 self
https://bugzilla.suse.com/912296 self
https://www.suse.com/security/cve/CVE-2014-0224/ self
https://www.suse.com/security/cve/CVE-2014-3570/ self
https://www.suse.com/security/cve/CVE-2014-3571/ self
https://www.suse.com/security/cve/CVE-2014-3572/ self
https://www.suse.com/security/cve/CVE-2014-8275/ self
https://www.suse.com/security/cve/CVE-2015-0204/ self
https://www.suse.com/security/cve/CVE-2015-0205/ self
https://www.suse.com/security/cve/CVE-2014-0224 external
https://bugzilla.suse.com/1146657 external
https://bugzilla.suse.com/880891 external
https://bugzilla.suse.com/881743 external
https://bugzilla.suse.com/883126 external
https://bugzilla.suse.com/885777 external
https://bugzilla.suse.com/892403 external
https://bugzilla.suse.com/901237 external
https://bugzilla.suse.com/903703 external
https://bugzilla.suse.com/905018 external
https://bugzilla.suse.com/905106 external
https://bugzilla.suse.com/914447 external
https://bugzilla.suse.com/915913 external
https://bugzilla.suse.com/916239 external
https://www.suse.com/security/cve/CVE-2014-3570 external
https://bugzilla.suse.com/912296 external
https://bugzilla.suse.com/915848 external
https://bugzilla.suse.com/927623 external
https://bugzilla.suse.com/937891 external
https://bugzilla.suse.com/944456 external
https://www.suse.com/security/cve/CVE-2014-3571 external
https://bugzilla.suse.com/912294 external
https://bugzilla.suse.com/915848 external
https://bugzilla.suse.com/927623 external
https://www.suse.com/security/cve/CVE-2014-3572 external
https://bugzilla.suse.com/912015 external
https://bugzilla.suse.com/915848 external
https://bugzilla.suse.com/927623 external
https://bugzilla.suse.com/937891 external
https://www.suse.com/security/cve/CVE-2014-8275 external
https://bugzilla.suse.com/912018 external
https://bugzilla.suse.com/915848 external
https://bugzilla.suse.com/927623 external
https://bugzilla.suse.com/937891 external
https://www.suse.com/security/cve/CVE-2015-0204 external
https://bugzilla.suse.com/912014 external
https://bugzilla.suse.com/920482 external
https://bugzilla.suse.com/920484 external
https://bugzilla.suse.com/927591 external
https://bugzilla.suse.com/927623 external
https://bugzilla.suse.com/936787 external
https://bugzilla.suse.com/952088 external
https://www.suse.com/security/cve/CVE-2015-0205 external
https://bugzilla.suse.com/912293 external
https://bugzilla.suse.com/915848 external
https://bugzilla.suse.com/927623 external
https://bugzilla.suse.com/937891 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for compat-openssl098",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThe openssl 0.9.8j compatibility package was updated to fix several security vulnerabilities:\n\nCVE-2014-3570: Bignum squaring (BN_sqr) may produce incorrect results\non some platforms, including x86_64.\n\nCVE-2014-3571: Fix crash in dtls1_get_record whilst in the listen state where\nyou get two separate reads performed - one for the header and\none for the body of the handshake record.\n\nCVE-2014-3572: Do not accept a handshake using an ephemeral ECDH ciphersuites\nwith the server key exchange message omitted.\n\nCVE-2014-8275: Fixed various certificate fingerprint issues\n\nCVE-2015-0204: Only allow ephemeral RSA keys in export ciphersuites\n\nCVE-2015-0205: OpenSSL 0.9.8j is NOT vulnerable to CVE-2015-0205 as it doesn\u0027t\nsupport DH certificates and this typo prohibits skipping of\ncertificate verify message for sign only certificates anyway.\n(This patch only fixes the wrong condition)\n\nThis update also fixes regression caused by CVE-2014-0224.patch (bnc#892403)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-DESKTOP-12-2015-78,SUSE-SLE-Module-Legacy-12-2015-78",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2015_0305-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2015:0305-1",
        "url": "https://www.suse.com/support/update/announcement/2015/suse-su-20150305-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2015:0305-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2015-February/001232.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 892403",
        "url": "https://bugzilla.suse.com/892403"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912014",
        "url": "https://bugzilla.suse.com/912014"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912015",
        "url": "https://bugzilla.suse.com/912015"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912018",
        "url": "https://bugzilla.suse.com/912018"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912293",
        "url": "https://bugzilla.suse.com/912293"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912294",
        "url": "https://bugzilla.suse.com/912294"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 912296",
        "url": "https://bugzilla.suse.com/912296"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-0224 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-0224/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3570 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3570/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3571 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3571/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3572 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3572/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-8275 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-8275/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-0204 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-0204/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-0205 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-0205/"
      }
    ],
    "title": "Security update for compat-openssl098",
    "tracking": {
      "current_release_date": "2015-02-04T12:44:14Z",
      "generator": {
        "date": "2015-02-04T12:44:14Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2015:0305-1",
      "initial_release_date": "2015-02-04T12:44:14Z",
      "revision_history": [
        {
          "date": "2015-02-04T12:44:14Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libopenssl0_9_8-0.9.8j-70.2.s390x",
                "product": {
                  "name": "libopenssl0_9_8-0.9.8j-70.2.s390x",
                  "product_id": "libopenssl0_9_8-0.9.8j-70.2.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
                "product": {
                  "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
                  "product_id": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libopenssl0_9_8-0.9.8j-70.2.x86_64",
                "product": {
                  "name": "libopenssl0_9_8-0.9.8j-70.2.x86_64",
                  "product_id": "libopenssl0_9_8-0.9.8j-70.2.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
                "product": {
                  "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
                  "product_id": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Desktop 12",
                "product": {
                  "name": "SUSE Linux Enterprise Desktop 12",
                  "product_id": "SUSE Linux Enterprise Desktop 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sled:12"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Legacy 12",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Legacy 12",
                  "product_id": "SUSE Linux Enterprise Module for Legacy 12",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-legacy:12"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-0.9.8j-70.2.x86_64 as component of SUSE Linux Enterprise Desktop 12",
          "product_id": "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64"
        },
        "product_reference": "libopenssl0_9_8-0.9.8j-70.2.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64 as component of SUSE Linux Enterprise Desktop 12",
          "product_id": "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        },
        "product_reference": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Desktop 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-0.9.8j-70.2.s390x as component of SUSE Linux Enterprise Module for Legacy 12",
          "product_id": "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x"
        },
        "product_reference": "libopenssl0_9_8-0.9.8j-70.2.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-0.9.8j-70.2.x86_64 as component of SUSE Linux Enterprise Module for Legacy 12",
          "product_id": "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64"
        },
        "product_reference": "libopenssl0_9_8-0.9.8j-70.2.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x as component of SUSE Linux Enterprise Module for Legacy 12",
          "product_id": "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x"
        },
        "product_reference": "libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64 as component of SUSE Linux Enterprise Module for Legacy 12",
          "product_id": "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        },
        "product_reference": "libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Legacy 12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-0224",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-0224"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the \"CCS Injection\" vulnerability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-0224",
          "url": "https://www.suse.com/security/cve/CVE-2014-0224"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1146657 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/1146657"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 880891 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/880891"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 881743 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/881743"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 883126 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/883126"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 885777 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/885777"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 892403 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/892403"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901237 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/901237"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 903703 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/903703"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 905018 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/905018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 905106 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/905106"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 914447 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/914447"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915913 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/915913"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 916239 for CVE-2014-0224",
          "url": "https://bugzilla.suse.com/916239"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "important"
        }
      ],
      "title": "CVE-2014-0224"
    },
    {
      "cve": "CVE-2014-3570",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3570"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3570",
          "url": "https://www.suse.com/security/cve/CVE-2014-3570"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912296 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/912296"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937891 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/937891"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 944456 for CVE-2014-3570",
          "url": "https://bugzilla.suse.com/944456"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-3570"
    },
    {
      "cve": "CVE-2014-3571",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3571"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3571",
          "url": "https://www.suse.com/security/cve/CVE-2014-3571"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912294 for CVE-2014-3571",
          "url": "https://bugzilla.suse.com/912294"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2014-3571",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2014-3571",
          "url": "https://bugzilla.suse.com/927623"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-3571"
    },
    {
      "cve": "CVE-2014-3572",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3572"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3572",
          "url": "https://www.suse.com/security/cve/CVE-2014-3572"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912015 for CVE-2014-3572",
          "url": "https://bugzilla.suse.com/912015"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2014-3572",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2014-3572",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937891 for CVE-2014-3572",
          "url": "https://bugzilla.suse.com/937891"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-3572"
    },
    {
      "cve": "CVE-2014-8275",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-8275"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate\u0027s unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-8275",
          "url": "https://www.suse.com/security/cve/CVE-2014-8275"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912018 for CVE-2014-8275",
          "url": "https://bugzilla.suse.com/912018"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2014-8275",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2014-8275",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937891 for CVE-2014-8275",
          "url": "https://bugzilla.suse.com/937891"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-8275"
    },
    {
      "cve": "CVE-2015-0204",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-0204"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the \"FREAK\" issue.  NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-0204",
          "url": "https://www.suse.com/security/cve/CVE-2015-0204"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912014 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/912014"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 920482 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/920482"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 920484 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/920484"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927591 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/927591"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 936787 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/936787"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 952088 for CVE-2015-0204",
          "url": "https://bugzilla.suse.com/952088"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2015-0204"
    },
    {
      "cve": "CVE-2015-0205",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-0205"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, which allows remote attackers to obtain access without knowledge of a private key via crafted TLS Handshake Protocol traffic to a server that recognizes a Certification Authority with DH support.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
          "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-0205",
          "url": "https://www.suse.com/security/cve/CVE-2015-0205"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 912293 for CVE-2015-0205",
          "url": "https://bugzilla.suse.com/912293"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 915848 for CVE-2015-0205",
          "url": "https://bugzilla.suse.com/915848"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 927623 for CVE-2015-0205",
          "url": "https://bugzilla.suse.com/927623"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 937891 for CVE-2015-0205",
          "url": "https://bugzilla.suse.com/937891"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Desktop 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-0.9.8j-70.2.x86_64",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.s390x",
            "SUSE Linux Enterprise Module for Legacy 12:libopenssl0_9_8-32bit-0.9.8j-70.2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2015-02-04T12:44:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2015-0205"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.