openssl-1.0.2k-22.el7

エラータID: AXSA:2021-2463:03

Release date: 
Tuesday, October 12, 2021 - 17:02
Subject: 
openssl-1.0.2k-22.el7
Affected Channels: 
Asianux Server 7 for x86_64
Severity: 
Moderate
Description: 

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

* openssl: integer overflow in CipherUpdate (CVE-2021-23840)
* openssl: NULL pointer dereference in X509_issuer_and_serial_hash() (CVE-2021-23841)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2021-23840
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
CVE-2021-23841
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. openssl-1.0.2k-22.el7.src.rpm
    MD5: 9ac5ce14d96153beb9a1155646bb53f6
    SHA-256: 1950fbd263d72cec5ec96ac3ed3a21f581846a565df096b64a787e0a5bb8fd20
    Size: 3.59 MB

Asianux Server 7 for x86_64
  1. openssl-1.0.2k-22.el7.x86_64.rpm
    MD5: 1dcaf07e438ea059fb8660b983f12b39
    SHA-256: c720a3fc5bda17d3fac1cbbb97ada80cae37c655b2ce7bbe766d835542b959c5
    Size: 492.70 kB
  2. openssl-devel-1.0.2k-22.el7.x86_64.rpm
    MD5: 8eb132d0ffd9ca4d21481d0ec2b04611
    SHA-256: a284ec46d0e659adc096d13502a5c2465a1b398628db243564f56918ed168bab
    Size: 1.51 MB
  3. openssl-libs-1.0.2k-22.el7.x86_64.rpm
    MD5: 42e08d0d64afbb3766fcc5524c65ee5a
    SHA-256: 62cb19078a8168efb68aeabf013bc0dbb8517dba6c547923ba8ac50e0b0ef636
    Size: 1.20 MB
  4. openssl-devel-1.0.2k-22.el7.i686.rpm
    MD5: dc8de49aca09b7421366f238d9e0f705
    SHA-256: 2577eab0bbf457ee0e38a512e04bdaa4d7b600c92e4a6a0ebdf56bef9830948d
    Size: 1.51 MB
  5. openssl-libs-1.0.2k-22.el7.i686.rpm
    MD5: 4e5df3ff7c604e4bf485c79c93601dff
    SHA-256: 9d56f087b1f0c9f12fd3ff6caddb0da8a5dbc63a9b5a81296bff4efcde7a27d5
    Size: 0.97 MB