ELSA-2023-3722

ELSA-2023-3722 - openssl security and bug fix update

Type:	SECURITY
Severity:	MODERATE
Release Date:	2023-06-22

Description

[3.0.7-16.0.1]
- Replace upstream references [Orabug: 34340177]

[1:3.0.7-16]
- Fix possible DoS translating ASN.1 object identifiers
Resolves: CVE-2023-2650
- Release the DRBG in global default libctx early
Resolves: rhbz#2211396

[1:3.0.7-15.1]
- Re-enable DHX keys in FIPS mode, disable FIPS 186-4 parameter validation and generation in FIPS mode
Resolves: rhbz#2178030

[1:3.0.7-15]
- Enforce using EMS in FIPS mode - alerts tuning
Related: rhbz#2157951

[1:3.0.7-14]
- Input buffer over-read in AES-XTS implementation on 64 bit ARM
Resolves: rhbz#2188554

[1:3.0.7-13]
- Enforce using EMS in FIPS mode
Resolves: rhbz#2157951
- Fix excessive resource usage in verifying X509 policy constraints
Resolves: rhbz#2186661
- Fix invalid certificate policies in leaf certificates check
Resolves: rhbz#2187429
- Certificate policy check not enabled
Resolves: rhbz#2187431
- OpenSSL rsa_verify_recover key length checks in FIPS mode
Resolves: rhbz#2186819

[1:3.0.7-12]
- Change explicit FIPS indicator for RSA decryption to unapproved
Resolves: rhbz#2179379

[1:3.0.7-11]
- Add missing reference to patchfile to add explicit FIPS indicator to RSA
encryption and RSASVE and fix the gettable parameter list for the RSA
asymmetric cipher implementation.
Resolves: rhbz#2179379

[1:3.0.7-10]
- Add explicit FIPS indicator to RSA encryption and RSASVE
Resolves: rhbz#2179379

[1:3.0.7-9]
- Fix explicit FIPS indicator for X9.42 KDF when used with output lengths < 14 bytes
Resolves: rhbz#2175864

[1:3.0.7-8]
- Fix Wpointer-sign compiler warning
Resolves: rhbz#2178034

[1:3.0.7-7]
- Add explicit FIPS indicators to key derivation functions
Resolves: rhbz#2175860 rhbz#2175864
- Zeroize FIPS module integrity check MAC after check
Resolves: rhbz#2175873
- Add explicit FIPS indicator for IV generation in AES-GCM
Resolves: rhbz#2175868
- Add explicit FIPS indicator for PBKDF2, use test vector with FIPS-compliant
salt in PBKDF2 FIPS self-test
Resolves: rhbz#2178137
- Limit RSA_NO_PADDING for encryption and signature in FIPS mode
Resolves: rhbz#2178029
- Pairwise consistency tests should use Digest+Sign/Verify
Resolves: rhbz#2178034
- Forbid DHX keys import in FIPS mode
Resolves: rhbz#2178030
- DH PCT should abort on failure
Resolves: rhbz#2178039
- Increase RNG seeding buffer size to 32
Related: rhbz#2168224

Related CVEs

CVE-2023-2650

CVE-2023-0465

CVE-2023-0464

CVE-2023-0466

CVE-2023-1255

Updated Packages

Release/Architecture	Filename	MD5sum	Superseded By Advisory
Oracle Linux 9 (aarch64)	openssl-3.0.7-16.0.1.el9_2.src.rpm	1330994999ee6159bdb5b33d55327320	-
	openssl-3.0.7-16.0.1.el9_2.aarch64.rpm	51b5d16f243e3673c273e9367cded388	-
	openssl-devel-3.0.7-16.0.1.el9_2.aarch64.rpm	b5fe64bb984e884d1d0e4038c46ab668	-
	openssl-libs-3.0.7-16.0.1.el9_2.aarch64.rpm	94f425d6bf55a372ee9d6e61d37044c2	-
	openssl-perl-3.0.7-16.0.1.el9_2.aarch64.rpm	3c708a54fc58ac530e805e36049738c5	-
Oracle Linux 9 (x86_64)	openssl-3.0.7-16.0.1.el9_2.src.rpm	1330994999ee6159bdb5b33d55327320	-
	openssl-3.0.7-16.0.1.el9_2.x86_64.rpm	802e089a589b6d4ca43c49362a6ac283	-
	openssl-devel-3.0.7-16.0.1.el9_2.i686.rpm	5b28e2f049e0b8a24d29312677bfdc5e	-
	openssl-devel-3.0.7-16.0.1.el9_2.x86_64.rpm	ea7d82eeb0d73bf9064a8528a55d9851	-
	openssl-libs-3.0.7-16.0.1.el9_2.i686.rpm	e28868b6776380c67c0097ed23ca56e4	-
	openssl-libs-3.0.7-16.0.1.el9_2.x86_64.rpm	608876de540e84ca246cc8263cee7a50	-
	openssl-perl-3.0.7-16.0.1.el9_2.x86_64.rpm	9dca1300bf038c92778eeeac800a8209	-

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team