Re: AW: [security-announce] SUSE-SU-2014:1361-1: important: Security update for OpenSSL
Thomas Biege <[email protected]>
| Newsgroups | gmane.linux.suse.security |
|---|---|
| Message-ID | <[email protected]> |
Hi, nothing special here, yesterday we talked about openssl1 and the advisory mentioned below is an openssl 0.9 update for SLE11 which also contains the new SCSV feature. With this feature an application that uses it can detect downgrade attacks. Still, your services should be configured to only use TLS. HTH Thomas On November 6, 2014 7:51:00 AM CET, [email protected] wrote: >Hello, > >yesterday, you pronounced a patch for sle11 openssl1. > >SUSE-SU-2014:1357-1 > >When I asked you, if we would need the poodle workaround any longer >after installing this patch, you answerd: yes, because the patch was >only for a special product. > >Now, what about this patch: it seemed to me, that it includes the >poodle leak. Do we - after installing it - still need the workaround as >described here: > >https://www.suse.com/support/kb/doc.php?id=7015773 > >Thanks. > > >Mit freundlichem Gruß >Hans Paffrath > >Stadt Köln - Der Oberbürgermeister >Amt für Informationsverarbeitung >Willy-Brandt-Platz 3 >50679 Köln > >Telefon: 0221/221-26085 >Telefax: 0221/221-22845 >E-Mail: [email protected] >Internet: www.stadt-koeln.de > > > >-----Ursprüngliche Nachricht----- >Von: [email protected] >[mailto:[email protected]] >Gesendet: Mittwoch, 5. November 2014 23:05 >An: [email protected] >Betreff: [security-announce] SUSE-SU-2014:1361-1: important: Security >update for OpenSSL > >SUSE Security Update: Security update for OpenSSL >______________________________________________________________________________ > >Announcement ID: SUSE-SU-2014:1361-1 >Rating: important >References: #892403 #901223 #901277 >Cross-References: CVE-2014-3566 CVE-2014-3567 CVE-2014-3568 > >Affected Products: > SUSE Linux Enterprise Software Development Kit 11 SP3 > SUSE Linux Enterprise Server 11 SP3 for VMware > SUSE Linux Enterprise Server 11 SP3 >SUSE Linux Enterprise Desktop 11 SP3 >______________________________________________________________________________ > > An update that fixes three vulnerabilities is now available. > >Description: > > > This OpenSSL update fixes the following issues: > > * Session Ticket Memory Leak (CVE-2014-3567) > * Build option no-ssl3 is incomplete (CVE-2014-3568) > * Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE) > > Security Issues: > > * CVE-2014-3567 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567> > * CVE-2014-3566 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566> > * CVE-2014-3568 > <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568> > >Indications: > > Everybody should update. > >Patch Instructions: > > To install this SUSE Security Update use YaST online_update. > Alternatively you can run the command listed for your product: > > - SUSE Linux Enterprise Software Development Kit 11 SP3: > > zypper in -t patch sdksp3-libopenssl-devel-9915 > > - SUSE Linux Enterprise Server 11 SP3 for VMware: > > zypper in -t patch slessp3-libopenssl-devel-9915 > > - SUSE Linux Enterprise Server 11 SP3: > > zypper in -t patch slessp3-libopenssl-devel-9915 > > - SUSE Linux Enterprise Desktop 11 SP3: > > zypper in -t patch sledsp3-libopenssl-devel-9915 > > To bring your system up-to-date, use "zypper patch". > > >Package List: > >- SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 >ppc64 s390x x86_64): > > libopenssl-devel-0.9.8j-0.66.1 > > - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64): > > libopenssl0_9_8-0.9.8j-0.66.1 > libopenssl0_9_8-hmac-0.9.8j-0.66.1 > openssl-0.9.8j-0.66.1 > openssl-doc-0.9.8j-0.66.1 > > - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64): > > libopenssl0_9_8-32bit-0.9.8j-0.66.1 > libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1 > > - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64): > > libopenssl0_9_8-0.9.8j-0.66.1 > libopenssl0_9_8-hmac-0.9.8j-0.66.1 > openssl-0.9.8j-0.66.1 > openssl-doc-0.9.8j-0.66.1 > > - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64): > > libopenssl0_9_8-32bit-0.9.8j-0.66.1 > libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1 > > - SUSE Linux Enterprise Server 11 SP3 (ia64): > > libopenssl0_9_8-x86-0.9.8j-0.66.1 > > - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64): > > libopenssl0_9_8-0.9.8j-0.66.1 > openssl-0.9.8j-0.66.1 > > - SUSE Linux Enterprise Desktop 11 SP3 (x86_64): > > libopenssl0_9_8-32bit-0.9.8j-0.66.1 > > >References: > > http://support.novell.com/security/cve/CVE-2014-3566.html > http://support.novell.com/security/cve/CVE-2014-3567.html > http://support.novell.com/security/cve/CVE-2014-3568.html > https://bugzilla.suse.com/show_bug.cgi?id=892403 > https://bugzilla.suse.com/show_bug.cgi?id=901223 > https://bugzilla.suse.com/show_bug.cgi?id=901277 >http://download.suse.com/patch/finder/?keywords=e15c3470343095d331f7120ec6953c18 > >-- >To unsubscribe, e-mail: >[email protected] >For additional commands, e-mail: >[email protected] > >-- >To unsubscribe, e-mail: [email protected] >To contact the owner, e-mail: [email protected] -- Thomas Biege <[email protected]>, Team Leader MaintenanceSecurity, CSSLP SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB 21284 (AG Nürnberg)