Security update for openssl-3, libpulp, ulp-macros
This update for openssl-3, libpulp, ulp-macros fixes the following issues: openssl-3: - CVE-2024-6119: possible denial of service in X.509 name checks (bsc#1229465) - CVE-2024-5535: SSL_select_next_proto buffer overread (bsc#1227138) - CVE-2024-4741: Fixed a use-after-free with SSL_free_buffers (bsc#1225551) - CVE-2024-4603: Check DSA parameters for excessive sizes before validating (bsc#1224388) - CVE-2024-2511: Fix unconstrained session cache growth in TLSv1.3 (bsc#1222548) - FIPS: Deny SHA-1 signature verification in FIPS provider (bsc#1221365) - FIPS: RSA keygen PCT requirements. (bsc#1221760, bsc#1221753) - FIPS: Check that the fips provider is available before setting it as the default provider in FIPS mode. (bsc#1220523) - FIPS: Port openssl to use jitterentropy (bsc#1220523) - FIPS: Block non-Approved Elliptic Curves (bsc#1221786) - FIPS: Service Level Indicator (bsc#1221365) - FIPS: Output the FIPS-validation name and module version which uniquely identify the FIPS validated module. (bsc#1221751) - FIPS: Add required selftests (bsc#1221760) - FIPS: DH: Disable FIPS 186-4 Domain Parameters (bsc#1221821) - FIPS: Recommendation for Password-Based Key Derivation (bsc#1221827) - FIPS: Zeroization is required (bsc#1221752) - FIPS: Reseed DRBG (bsc#1220690, bsc#1220693, bsc#1220696) - FIPS: NIST SP 800-56Brev2 (bsc#1221824) - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 (bsc#1221787) - FIPS: Port openssl to use jitterentropy (bsc#1220523) - FIPS: NIST SP 800-56Arev3 (bsc#1221822) - FIPS: Error state has to be enforced (bsc#1221753) - Build with enabled sm2 and sm4 support (bsc#1222899) - fix non-reproducible build issue - Fix HDKF key derivation (bsc#1225291) - Enable livepatching support (bsc#1223428) libpulp: - Update package with libpulp-0.3.5 * Change .so load policy from lazy to eager. * Fix patch of references when mprotect is enabled. * Fix tramposed calloc arguments. * Fix crash of ulp packer on empty lines. - Disabled ptrace_scope through aaa_base-enable-ptrace package (bsc#1221763). - Update package with libpulp-0.3.4: * Add debuginfo into ulp extract. - Disabled ptrace_scope when building the package (bsc#1221763). - Update package with libpulp-0.3.3: * Fixed a race condition when process list is empty. * Removed "Unable to get section data" error message (bsc#1223306). * Bumped asunsafe_conversion attempts from 100 to 2000. * Fixed banner test on clang-18. * Check if ptrace_scope is enabled when attempting a ptrace operation (bsc#1221763). - Update package with libpulp-0.3.1: * Add timestamp information on `ulp patches`. ulp-macros: - Initial release.
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for openssl-3, libpulp, ulp-macros fixes the following issues: openssl-3: - CVE-2024-6119: possible denial of service in X.509 name checks (bsc#1229465) - CVE-2024-5535: SSL_select_next_proto buffer overread (bsc#1227138) - CVE-2024-4741: Fixed a use-after-free with SSL_free_buffers (bsc#1225551) - CVE-2024-4603: Check DSA parameters for excessive sizes before validating (bsc#1224388) - CVE-2024-2511: Fix unconstrained session cache growth in TLSv1.3 (bsc#1222548) - FIPS: Deny SHA-1 signature verification in FIPS provider (bsc#1221365) - FIPS: RSA keygen PCT requirements. (bsc#1221760, bsc#1221753) - FIPS: Check that the fips provider is available before setting it as the default provider in FIPS mode. (bsc#1220523) - FIPS: Port openssl to use jitterentropy (bsc#1220523) - FIPS: Block non-Approved Elliptic Curves (bsc#1221786) - FIPS: Service Level Indicator (bsc#1221365) - FIPS: Output the FIPS-validation name and module version which uniquely identify the FIPS validated module. (bsc#1221751) - FIPS: Add required selftests (bsc#1221760) - FIPS: DH: Disable FIPS 186-4 Domain Parameters (bsc#1221821) - FIPS: Recommendation for Password-Based Key Derivation (bsc#1221827) - FIPS: Zeroization is required (bsc#1221752) - FIPS: Reseed DRBG (bsc#1220690, bsc#1220693, bsc#1220696) - FIPS: NIST SP 800-56Brev2 (bsc#1221824) - FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 (bsc#1221787) - FIPS: Port openssl to use jitterentropy (bsc#1220523) - FIPS: NIST SP 800-56Arev3 (bsc#1221822) - FIPS: Error state has to be enforced (bsc#1221753) - Build with enabled sm2 and sm4 support (bsc#1222899) - fix non-reproducible build issue - Fix HDKF key derivation (bsc#1225291) - Enable livepatching support (bsc#1223428) libpulp: - Update package with libpulp-0.3.5 * Change .so load policy from lazy to eager. * Fix patch of references when mprotect is enabled. * Fix tramposed calloc arguments. * Fix crash of ulp packer on empty lines. - Disabled ptrace_scope through aaa_base-enable-ptrace package (bsc#1221763). - Update package with libpulp-0.3.4: * Add debuginfo into ulp extract. - Disabled ptrace_scope when building the package (bsc#1221763). - Update package with libpulp-0.3.3: * Fixed a race condition when process list is empty. * Removed "Unable to get section data" error message (bsc#1223306). * Bumped asunsafe_conversion attempts from 100 to 2000. * Fixed banner test on clang-18. * Check if ptrace_scope is enabled when attempting a ptrace operation (bsc#1221763). - Update package with libpulp-0.3.1: * Add timestamp information on `ulp patches`. ulp-macros: - Initial release.
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1220523
- https://bugzilla.suse.com/1220690
- https://bugzilla.suse.com/1220693
- https://bugzilla.suse.com/1220696
- https://bugzilla.suse.com/1221365
- https://bugzilla.suse.com/1221751
- https://bugzilla.suse.com/1221752
- https://bugzilla.suse.com/1221753
- https://bugzilla.suse.com/1221760
- https://bugzilla.suse.com/1221763
- https://bugzilla.suse.com/1221786
- https://bugzilla.suse.com/1221787
- https://bugzilla.suse.com/1221821
- https://bugzilla.suse.com/1221822
- https://bugzilla.suse.com/1221824
- https://bugzilla.suse.com/1221827
- https://bugzilla.suse.com/1222548
- https://bugzilla.suse.com/1222899
- https://bugzilla.suse.com/1223306
- https://bugzilla.suse.com/1223336
- https://bugzilla.suse.com/1223428
- https://bugzilla.suse.com/1224388
- https://bugzilla.suse.com/1225291
- https://bugzilla.suse.com/1225551
- https://bugzilla.suse.com/1226463
- https://bugzilla.suse.com/1227138
- https://bugzilla.suse.com/1229465
- https://www.suse.com/security/cve/CVE-2024-2511
- https://www.suse.com/security/cve/CVE-2024-4603
- https://www.suse.com/security/cve/CVE-2024-4741
- https://www.suse.com/security/cve/CVE-2024-5535
- https://www.suse.com/security/cve/CVE-2024-6119
- https://www.suse.com/support/update/announcement/2025/suse-su-202520014-1/