SUSE-SU-2015:1150-1

Dashboard / Vulnerabilities / SUSE-SU-2015:1150-1

SUSE-SU-2015:1150-1

Summary: Security update for compat-openssl098

Details: This update fixes the following security issues: - CVE-2015-4000 (boo#931698) * The Logjam Attack / weakdh.org * reject connections with DH parameters shorter than 1024 bits * generates 2048-bit DH parameters by default - CVE-2015-1788 (boo#934487) * Malformed ECParameters causes infinite loop - CVE-2015-1789 (boo#934489) * Exploitable out-of-bounds read in X509_cmp_time - CVE-2015-1790 (boo#934491) * PKCS7 crash with missing EnvelopedContent - CVE-2015-1792 (boo#934493) * CMS verify infinite loop with unknown hash function - CVE-2015-1791 (boo#933911) * race condition in NewSessionTicket - CVE-2015-3216 (boo#933898) * Crash in ssleay_rand_bytes due to locking regression * modified openssl-1.0.1i-fipslocking.patch - fix timing side channel in RSA decryption (bnc#929678) - add ECC ciphersuites to DEFAULT (bnc#879179) - Disable EXPORT ciphers by default (bnc#931698, comment #3)

References: https://www.suse.com/support/update/announcement/2015/suse-su-20151150-1/, https://bugzilla.suse.com/879179, https://bugzilla.suse.com/929678, https://bugzilla.suse.com/931698, https://bugzilla.suse.com/933898, https://bugzilla.suse.com/933911, https://bugzilla.suse.com/934487, https://bugzilla.suse.com/934489, https://bugzilla.suse.com/934491, https://bugzilla.suse.com/934493, https://www.suse.com/security/cve/CVE-2015-1788, https://www.suse.com/security/cve/CVE-2015-1789, https://www.suse.com/security/cve/CVE-2015-1790, https://www.suse.com/security/cve/CVE-2015-1791, https://www.suse.com/security/cve/CVE-2015-1792, https://www.suse.com/security/cve/CVE-2015-3216, https://www.suse.com/security/cve/CVE-2015-4000