Security update for compat-openssl098

Announcement ID:	SUSE-SU-2018:2683-1
Rating:	moderate
References:	bsc#1087102 bsc#1089039 bsc#1097158 bsc#1097624 bsc#1098592
Cross-References:	CVE-2018-0732 CVE-2018-0737 CVE-2018-0739
CVSS scores:	CVE-2018-0732 ( SUSE ): 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2018-0732 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-0732 ( NVD ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-0737 ( SUSE ): 4.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2018-0737 ( NVD ): 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2018-0739 ( SUSE ): 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2018-0739 ( NVD ): 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:	Legacy Module 12 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP2 SUSE Linux Enterprise High Performance Computing 12 SP3 SUSE Linux Enterprise High Performance Computing 12 SP4 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise Server 12 SUSE Linux Enterprise Server 12 SP1 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server 12 SP4 SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5

An update that solves three vulnerabilities and has two security fixes can now be installed.

Description:

This update for compat-openssl098 fixes the following security issues:

• CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158)
• Blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)
• CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039)
• CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could have resulted in DoS (bsc#1087102).

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Desktop 12 SP3
  zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2018-1872=1
• Legacy Module 12
  zypper in -t patch SUSE-SLE-Module-Legacy-12-2018-1872=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1
  zypper in -t patch SUSE-SLE-SAP-12-SP1-2018-1872=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2
  zypper in -t patch SUSE-SLE-SAP-12-SP2-2018-1872=1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3
  zypper in -t patch SUSE-SLE-SAP-12-SP3-2018-1872=1

Package List:

• SUSE Linux Enterprise Desktop 12 SP3 (x86_64)
  • libopenssl0_9_8-debuginfo-0.9.8j-106.6.1
  • libopenssl0_9_8-32bit-0.9.8j-106.6.1
  • libopenssl0_9_8-debuginfo-32bit-0.9.8j-106.6.1
  • libopenssl0_9_8-0.9.8j-106.6.1
  • compat-openssl098-debugsource-0.9.8j-106.6.1
• Legacy Module 12 (s390x x86_64)
  • libopenssl0_9_8-debuginfo-0.9.8j-106.6.1
  • libopenssl0_9_8-32bit-0.9.8j-106.6.1
  • libopenssl0_9_8-debuginfo-32bit-0.9.8j-106.6.1
  • libopenssl0_9_8-0.9.8j-106.6.1
  • compat-openssl098-debugsource-0.9.8j-106.6.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP1 (x86_64)
  • libopenssl0_9_8-0.9.8j-106.6.1
  • libopenssl0_9_8-debuginfo-0.9.8j-106.6.1
  • compat-openssl098-debugsource-0.9.8j-106.6.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP2 (x86_64)
  • libopenssl0_9_8-0.9.8j-106.6.1
  • libopenssl0_9_8-debuginfo-0.9.8j-106.6.1
  • compat-openssl098-debugsource-0.9.8j-106.6.1
• SUSE Linux Enterprise Server for SAP Applications 12 SP3 (x86_64)
  • libopenssl0_9_8-0.9.8j-106.6.1
  • libopenssl0_9_8-debuginfo-0.9.8j-106.6.1
  • compat-openssl098-debugsource-0.9.8j-106.6.1

References:

• https://www.suse.com/security/cve/CVE-2018-0732.html
• https://www.suse.com/security/cve/CVE-2018-0737.html
• https://www.suse.com/security/cve/CVE-2018-0739.html
• https://bugzilla.suse.com/show_bug.cgi?id=1087102
• https://bugzilla.suse.com/show_bug.cgi?id=1089039
• https://bugzilla.suse.com/show_bug.cgi?id=1097158
• https://bugzilla.suse.com/show_bug.cgi?id=1097624
• https://bugzilla.suse.com/show_bug.cgi?id=1098592