openSUSE Security Update: Security update for Botan ______________________________________________________________________________ Announcement ID: openSUSE-SU-2024:0201-1 Rating: moderate References: #1227238 #1227607 #1227608 Cross-References: CVE-2024-34702 CVE-2024-34703 CVE-2024-39312 CVSS scores: CVE-2024-34702 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2024-34703 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVE-2024-39312 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP5 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for Botan fixes the following issues: Update to 2.19.5: * Fix multiple Denial of service attacks due to X.509 cert processing: * CVE-2024-34702 - boo#1227238 * CVE-2024-34703 - boo#1227607 * CVE-2024-39312 - boo#1227608 * Fix a crash in OCB * Fix a test failure in compression with certain versions of zlib * Fix some iterator debugging errors in TLS CBC decryption. * Avoid a miscompilation in ARIA when using XCode 14 Patch Instructions: To install this openSUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Backports SLE-15-SP5: zypper in -t patch openSUSE-2024-201=1 Package List: - openSUSE Backports SLE-15-SP5 (aarch64 i586 ppc64le s390x x86_64): Botan-2.19.5-bp155.2.3.1 libbotan-2-19-2.19.5-bp155.2.3.1 libbotan-devel-2.19.5-bp155.2.3.1 python3-botan-2.19.5-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (aarch64_ilp32): libbotan-2-19-64bit-2.19.5-bp155.2.3.1 libbotan-devel-64bit-2.19.5-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (x86_64): libbotan-2-19-32bit-2.19.5-bp155.2.3.1 libbotan-devel-32bit-2.19.5-bp155.2.3.1 - openSUSE Backports SLE-15-SP5 (noarch): Botan-doc-2.19.5-bp155.2.3.1 References: https://www.suse.com/security/cve/CVE-2024-34702.html https://www.suse.com/security/cve/CVE-2024-34703.html https://www.suse.com/security/cve/CVE-2024-39312.html https://bugzilla.suse.com/1227238 https://bugzilla.suse.com/1227607 https://bugzilla.suse.com/1227608