Security update for openssl-3
This update for openssl-3 fixes the following issues: - Update to version 3.0.8 (bsc#1207541). - CVE-2022-40735: Fixed remote trigger of expensive server-side DHE modular-exponentiation with long exponents in Diffie-Hellman Key Agreement Protocol (bsc#1205476). - CVE-2023-1255: Fixed input buffer over-read in AES-XTS implementation on 64 bit ARM (bsc#1210714). - CVE-2023-2650: Fixed possible DoS translating ASN.1 object identifiers (bsc#1211430).
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for openssl-3 fixes the following issues: - Update to version 3.0.8 (bsc#1207541). - CVE-2022-40735: Fixed remote trigger of expensive server-side DHE modular-exponentiation with long exponents in Diffie-Hellman Key Agreement Protocol (bsc#1205476). - CVE-2023-1255: Fixed input buffer over-read in AES-XTS implementation on 64 bit ARM (bsc#1210714). - CVE-2023-2650: Fixed possible DoS translating ASN.1 object identifiers (bsc#1211430).
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1205476
- https://bugzilla.suse.com/1210714
- https://bugzilla.suse.com/1211430
- https://www.suse.com/security/cve/CVE-2022-40735
- https://www.suse.com/security/cve/CVE-2023-1255
- https://www.suse.com/security/cve/CVE-2023-2650
- https://www.suse.com/support/update/announcement/2023/suse-su-20232470-1/