SUSE-SU-2019:1553-1

    Dashboard / Vulnerabilities / SUSE-SU-2019:1553-1

    SUSE-SU-2019:1553-1

    Published: 18 Jun 2019Last Modified: 4 Feb 2026

    Summary: Security update for openssl

    Details: This update for openssl fixes the following issues: - CVE-2018-0732: Reject excessively large primes in DH key generation (bsc#1097158) - CVE-2018-0734: Timing vulnerability in DSA signature generation (bsc#1113652) - CVE-2018-0737: Cache timing vulnerability in RSA Key Generation (bsc#1089039) - CVE-2018-5407: Elliptic curve scalar multiplication timing attack defenses (fixes 'PortSmash') (bsc#1113534) - CVE-2019-1559: Fix 0-byte record padding oracle via SSL_shutdown (bsc#1127080) - Fix One&Done side-channel attack on RSA (bsc#1104789) - Reject invalid EC point coordinates (bsc#1131291) - The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS Implementations (bsc#1117951) - Add missing error string to CVE-2016-8610 fix (bsc#1110018#c9) - blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592) Non security fixes: - correct the error detection in the fips patch (bsc#1106197) - Add openssl(cli) Provide so the packages that require the openssl binary can require this instead of the new openssl meta package (bsc#1101470)

    References: https://www.suse.com/support/update/announcement/2019/suse-su-20191553-1/, https://bugzilla.suse.com/1089039, https://bugzilla.suse.com/1097158, https://bugzilla.suse.com/1097624, https://bugzilla.suse.com/1098592, https://bugzilla.suse.com/1101470, https://bugzilla.suse.com/1104789, https://bugzilla.suse.com/1106197, https://bugzilla.suse.com/1110018, https://bugzilla.suse.com/1113534, https://bugzilla.suse.com/1113652, https://bugzilla.suse.com/1117951, https://bugzilla.suse.com/1127080, https://bugzilla.suse.com/1131291, https://www.suse.com/security/cve/CVE-2016-8610, https://www.suse.com/security/cve/CVE-2018-0732, https://www.suse.com/security/cve/CVE-2018-0734, https://www.suse.com/security/cve/CVE-2018-0737, https://www.suse.com/security/cve/CVE-2018-5407, https://www.suse.com/security/cve/CVE-2019-1559

    Affected packages

    Package

    Name: openssl

    Purl: pkg:rpm/suse/openssl&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSS

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.0.1i-27.34.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    SUSE-SU-2019:1553-1 | CVE-DB