Hello,
yesterday, you pronounced a patch for sle11 openssl1.
SUSE-SU-2014:1357-1
When I asked you, if we would need the poodle workaround any longer after installing this patch, you answerd: yes, because the patch was only for a special product.
Now, what about this patch: it seemed to me, that it includes the poodle leak. Do we - after installing it - still need the workaround as described here:
https://www.suse.com/support/kb/doc.php?id=7015773
Thanks.
Mit freundlichem Gruß
Hans Paffrath
Stadt Köln - Der Oberbürgermeister
Amt für Informationsverarbeitung
Willy-Brandt-Platz 3
50679 Köln
Telefon: 0221/221-26085
Telefax: 0221/221-22845
E-Mail: hans.paffrath@stadt-koeln.de
Internet: www.stadt-koeln.de
-----Ursprüngliche Nachricht-----
Von: opensuse-security@opensuse.org [mailto:opensuse-security@opensuse.org]
Gesendet: Mittwoch, 5. November 2014 23:05
An: opensuse-security-announce@opensuse.org
Betreff: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL
SUSE Security Update: Security update for OpenSSL
Announcement ID: SUSE-SU-2014:1361-1
Rating: important
References: #892403 #901223 #901277
Cross-References: CVE-2014-3566 CVE-2014-3567 CVE-2014-3568
Affected Products:
SUSE Linux Enterprise Software Development Kit 11 SP3
SUSE Linux Enterprise Server 11 SP3 for VMware
SUSE Linux Enterprise Server 11 SP3
SUSE Linux Enterprise Desktop 11 SP3
An update that fixes three vulnerabilities is now available.
Description:
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Indications:
Everybody should update.
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11 SP3:
zypper in -t patch sdksp3-libopenssl-devel-9915
- SUSE Linux Enterprise Server 11 SP3 for VMware:
zypper in -t patch slessp3-libopenssl-devel-9915
- SUSE Linux Enterprise Server 11 SP3:
zypper in -t patch slessp3-libopenssl-devel-9915
- SUSE Linux Enterprise Desktop 11 SP3:
zypper in -t patch sledsp3-libopenssl-devel-9915
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64):
libopenssl-devel-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):
libopenssl0_9_8-0.9.8j-0.66.1
libopenssl0_9_8-hmac-0.9.8j-0.66.1
openssl-0.9.8j-0.66.1
openssl-doc-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64):
libopenssl0_9_8-32bit-0.9.8j-0.66.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):
libopenssl0_9_8-0.9.8j-0.66.1
libopenssl0_9_8-hmac-0.9.8j-0.66.1
openssl-0.9.8j-0.66.1
openssl-doc-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64):
libopenssl0_9_8-32bit-0.9.8j-0.66.1
libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 (ia64):
libopenssl0_9_8-x86-0.9.8j-0.66.1
- SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):
libopenssl0_9_8-0.9.8j-0.66.1
openssl-0.9.8j-0.66.1
- SUSE Linux Enterprise Desktop 11 SP3 (x86_64):
libopenssl0_9_8-32bit-0.9.8j-0.66.1
References:
http://support.novell.com/security/cve/CVE-2014-3566.html
http://support.novell.com/security/cve/CVE-2014-3567.html
http://support.novell.com/security/cve/CVE-2014-3568.html
https://bugzilla.suse.com/show_bug.cgi?id=892403
https://bugzilla.suse.com/show_bug.cgi?id=901223
https://bugzilla.suse.com/show_bug.cgi?id=901277
http://download.suse.com/patch/finder/?keywords=e15c3470343095d331f7120ec6953c18
--
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
--
To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org
To contact the owner, e-mail: opensuse-security+owner@opensuse.org