openSUSE Build Service

Overview Details Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo (Revision 35b0b96c78a726099d0edbe110dea38b)

Currently displaying revision 35b0b96c78a726099d0edbe110dea38b , Show latest

<patchinfo>
  <issue id="901223" tracker="bnc">CVE-2014-3566: openssl: SSLv3 POODLE attack</issue>
  <issue id="901277" tracker="bnc">CVE-2014-3513, CVE-2014-3567: openssl: DTLS mem leak and session ticket mem leak</issue>
  <issue id="CVE-2014-3513" tracker="cve" />
  <issue id="CVE-2014-3568" tracker="cve" />
  <issue id="CVE-2014-3566" tracker="cve" />
  <issue id="CVE-2014-3567" tracker="cve" />
  <category>security</category>
  <rating>moderate</rating>
  <packager>vitezslav_cizek</packager>
  <description>- upgrade to 1.0.1j
  The following security issues were fixed in this update:
  * fixes bnc#901277 and bnc#901223
  *) SRTP Memory Leak.
     A flaw in the DTLS SRTP extension parsing code allows an attacker, who
     sends a carefully crafted handshake message, to cause OpenSSL to fail
     to free up to 64k of memory causing a memory leak. This could be
     exploited in a Denial Of Service attack. This issue affects OpenSSL
     1.0.1 server implementations for both SSL/TLS and DTLS regardless of
     whether SRTP is used or configured. Implementations of OpenSSL that
     have been compiled with OPENSSL_NO_SRTP defined are not affected.
     (CVE-2014-3513)
  *) Session Ticket Memory Leak.
     When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
     integrity of that ticket is first verified. In the event of a session
     ticket integrity check failing, OpenSSL will fail to free memory
     causing a memory leak. By sending a large number of invalid session
     tickets an attacker could exploit this issue in a Denial Of Service
     attack.
     (CVE-2014-3567)
  *) Build option no-ssl3 is incomplete.
     When OpenSSL is configured with "no-ssl3" as a build option, servers
     could accept and complete a SSL 3.0 handshake, and clients could be
     configured to send them.
     (CVE-2014-3568)
  *) Add support for TLS_FALLBACK_SCSV.
     Client applications doing fallback retries should call
     SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
     (CVE-2014-3566)
     [Adam Langley, Bodo Moeller]
  *) Add additional DigestInfo checks.
     Reencode DigestInto in DER and check against the original when
     verifying RSA signature: this will reject any improperly encoded
     DigestInfo structures.
     Note: this is a precautionary measure and no attacks are currently known.
</description>
  <summary>update for openssl</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo (Revision 35b0b96c78a726099d0edbe110dea38b)

Places