[opensuse-security] AW: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL
Hello, yesterday, you pronounced a patch for sle11 openssl1. SUSE-SU-2014:1357-1 When I asked you, if we would need the poodle workaround any longer after installing this patch, you answerd: yes, because the patch was only for a special product. Now, what about this patch: it seemed to me, that it includes the poodle leak. Do we - after installing it - still need the workaround as described here: https://www.suse.com/support/kb/doc.php?id=7015773 Thanks. Mit freundlichem Gruß Hans Paffrath Stadt Köln - Der Oberbürgermeister Amt für Informationsverarbeitung Willy-Brandt-Platz 3 50679 Köln Telefon: 0221/221-26085 Telefax: 0221/221-22845 E-Mail: hans.paffrath@stadt-koeln.de Internet: www.stadt-koeln.de -----Ursprüngliche Nachricht----- Von: opensuse-security@opensuse.org [mailto:opensuse-security@opensuse.org] Gesendet: Mittwoch, 5. November 2014 23:05 An: opensuse-security-announce@opensuse.org Betreff: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________ Announcement ID: SUSE-SU-2014:1361-1 Rating: important References: #892403 #901223 #901277 Cross-References: CVE-2014-3566 CVE-2014-3567 CVE-2014-3568 Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This OpenSSL update fixes the following issues: * Session Ticket Memory Leak (CVE-2014-3567) * Build option no-ssl3 is incomplete (CVE-2014-3568) * Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE) Security Issues: * CVE-2014-3567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567> * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> * CVE-2014-3568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568> Indications: Everybody should update. Patch Instructions: To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 11 SP3: zypper in -t patch sdksp3-libopenssl-devel-9915 - SUSE Linux Enterprise Server 11 SP3 for VMware: zypper in -t patch slessp3-libopenssl-devel-9915 - SUSE Linux Enterprise Server 11 SP3: zypper in -t patch slessp3-libopenssl-devel-9915 - SUSE Linux Enterprise Desktop 11 SP3: zypper in -t patch sledsp3-libopenssl-devel-9915 To bring your system up-to-date, use "zypper patch". Package List: - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl-devel-0.9.8j-0.66.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): libopenssl0_9_8-0.9.8j-0.66.1 libopenssl0_9_8-hmac-0.9.8j-0.66.1 openssl-0.9.8j-0.66.1 openssl-doc-0.9.8j-0.66.1 - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): libopenssl0_9_8-32bit-0.9.8j-0.66.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1 - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): libopenssl0_9_8-0.9.8j-0.66.1 libopenssl0_9_8-hmac-0.9.8j-0.66.1 openssl-0.9.8j-0.66.1 openssl-doc-0.9.8j-0.66.1 - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): libopenssl0_9_8-32bit-0.9.8j-0.66.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1 - SUSE Linux Enterprise Server 11 SP3 (ia64): libopenssl0_9_8-x86-0.9.8j-0.66.1 - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): libopenssl0_9_8-0.9.8j-0.66.1 openssl-0.9.8j-0.66.1 - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): libopenssl0_9_8-32bit-0.9.8j-0.66.1 References: http://support.novell.com/security/cve/CVE-2014-3566.html http://support.novell.com/security/cve/CVE-2014-3567.html http://support.novell.com/security/cve/CVE-2014-3568.html https://bugzilla.suse.com/show_bug.cgi?id=892403 https://bugzilla.suse.com/show_bug.cgi?id=901223 https://bugzilla.suse.com/show_bug.cgi?id=901277 http://download.suse.com/patch/finder/?keywords=e15c3470343095d331f7120ec695... -- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org -- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-security+owner@opensuse.org
On Thu, Nov 06, 2014 at 06:51:00AM +0000, hans.paffrath@stadt-koeln.de wrote:
When I asked you, if we would need the poodle workaround any longer after installing this patch, you answerd: yes, because the patch was only for a special product.
Now, what about this patch: it seemed to me, that it includes the poodle leak. Do we - after installing it - still need the workaround as described here:
It includes measures that can be used by applications to mitigate the issue. You still need to use the workarounds. Johannes -- Johannes Segitz SUSE Security Team GPG Key E7C81FA0 EE16 6BCE AD56 E034 BFB3 3ADD 7BF7 29D5 E7C8 1FA0 SUSE LINUX GmbH Maxfeldstraße 5 90409 Nürnberg, Germany GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 21284 (AG Nürnberg)
Hi, nothing special here, yesterday we talked about openssl1 and the advisory mentioned below is an openssl 0.9 update for SLE11 which also contains the new SCSV feature. With this feature an application that uses it can detect downgrade attacks. Still, your services should be configured to only use TLS. HTH Thomas On November 6, 2014 7:51:00 AM CET, hans.paffrath@stadt-koeln.de wrote:
Hello,
yesterday, you pronounced a patch for sle11 openssl1.
SUSE-SU-2014:1357-1
When I asked you, if we would need the poodle workaround any longer after installing this patch, you answerd: yes, because the patch was only for a special product.
Now, what about this patch: it seemed to me, that it includes the poodle leak. Do we - after installing it - still need the workaround as described here:
https://www.suse.com/support/kb/doc.php?id=7015773
Thanks.
Mit freundlichem Gruß Hans Paffrath
Stadt Köln - Der Oberbürgermeister Amt für Informationsverarbeitung Willy-Brandt-Platz 3 50679 Köln
Telefon: 0221/221-26085 Telefax: 0221/221-22845 E-Mail: hans.paffrath@stadt-koeln.de Internet: www.stadt-koeln.de
-----Ursprüngliche Nachricht----- Von: opensuse-security@opensuse.org [mailto:opensuse-security@opensuse.org] Gesendet: Mittwoch, 5. November 2014 23:05 An: opensuse-security-announce@opensuse.org Betreff: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL
SUSE Security Update: Security update for OpenSSL ______________________________________________________________________________
Announcement ID: SUSE-SU-2014:1361-1 Rating: important References: #892403 #901223 #901277 Cross-References: CVE-2014-3566 CVE-2014-3567 CVE-2014-3568
Affected Products: SUSE Linux Enterprise Software Development Kit 11 SP3 SUSE Linux Enterprise Server 11 SP3 for VMware SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Desktop 11 SP3 ______________________________________________________________________________
An update that fixes three vulnerabilities is now available.
Description:
This OpenSSL update fixes the following issues:
* Session Ticket Memory Leak (CVE-2014-3567) * Build option no-ssl3 is incomplete (CVE-2014-3568) * Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)
Security Issues:
* CVE-2014-3567 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567> * CVE-2014-3566 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> * CVE-2014-3568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Indications:
Everybody should update.
Patch Instructions:
To install this SUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Software Development Kit 11 SP3:
zypper in -t patch sdksp3-libopenssl-devel-9915
- SUSE Linux Enterprise Server 11 SP3 for VMware:
zypper in -t patch slessp3-libopenssl-devel-9915
- SUSE Linux Enterprise Server 11 SP3:
zypper in -t patch slessp3-libopenssl-devel-9915
- SUSE Linux Enterprise Desktop 11 SP3:
zypper in -t patch sledsp3-libopenssl-devel-9915
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64):
libopenssl-devel-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64):
libopenssl0_9_8-0.9.8j-0.66.1 libopenssl0_9_8-hmac-0.9.8j-0.66.1 openssl-0.9.8j-0.66.1 openssl-doc-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64):
libopenssl0_9_8-32bit-0.9.8j-0.66.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64):
libopenssl0_9_8-0.9.8j-0.66.1 libopenssl0_9_8-hmac-0.9.8j-0.66.1 openssl-0.9.8j-0.66.1 openssl-doc-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64):
libopenssl0_9_8-32bit-0.9.8j-0.66.1 libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1
- SUSE Linux Enterprise Server 11 SP3 (ia64):
libopenssl0_9_8-x86-0.9.8j-0.66.1
- SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64):
libopenssl0_9_8-0.9.8j-0.66.1 openssl-0.9.8j-0.66.1
- SUSE Linux Enterprise Desktop 11 SP3 (x86_64):
libopenssl0_9_8-32bit-0.9.8j-0.66.1
References:
http://support.novell.com/security/cve/CVE-2014-3566.html http://support.novell.com/security/cve/CVE-2014-3567.html http://support.novell.com/security/cve/CVE-2014-3568.html https://bugzilla.suse.com/show_bug.cgi?id=892403 https://bugzilla.suse.com/show_bug.cgi?id=901223 https://bugzilla.suse.com/show_bug.cgi?id=901277 http://download.suse.com/patch/finder/?keywords=e15c3470343095d331f7120ec695...
-- To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-security-announce+help@opensuse.org
-- To unsubscribe, e-mail: opensuse-security+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-security+owner@opensuse.org
-- Thomas Biege <thomas@suse.de>, Team Leader MaintenanceSecurity, CSSLP SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 21284 (AG Nürnberg)
participants (3)
-
hans.paffrath＠stadt-koeln.de -
Johannes Segitz -
Thomas Biege