Bug 41197

Summary:	openssl: multiple issues (4.1)
Product:	UCS	Reporter:	Arvid Requate <requate>
Component:	Security updates	Assignee:	Janek Walkenhorst <walkenhorst>
Status:	CLOSED FIXED	QA Contact:	Arvid Requate <requate>
Severity:	normal
Priority:	P4	CC:	gohmann, hahn, requate, walkenhorst
Version:	UCS 4.1	Flags:	requate: Patch_Available+
Target Milestone:	UCS 4.1-2-errata
Hardware:	Other
OS:	Linux
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):	Security
Max CVSS v3 score:
Bug Depends on:
Bug Blocks:	42486
Attachments:	openssl_patches_1.0.2d-0ubuntu1.5.tgz

Description Arvid Requate

2016-05-03 20:06:06 CEST

The new openssl release 1.0.2h fixes these issues:

* EVP_EncodeUpdate overflow (CVE-2016-2105)
* EVP_EncryptUpdate overflow (CVE-2016-2106)
* Padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
* Memory corruption in the ASN.1 encoder (CVE-2016-2108)
* ASN.1 BIO excessive memory allocation (CVE-2016-2109)
* EBCDIC overread (CVE-2016-2176)

Comment 1 Arvid Requate

2016-05-03 20:14:47 CEST

Created attachment 7636 [details]
openssl_patches_1.0.2d-0ubuntu1.5.tgz

Backport patches for 1.0.2d

Comment 2 Arvid Requate

2016-05-04 20:16:23 CEST

Debian sid currently has 1.0.2h-1

Comment 3 Janek Walkenhorst

2016-05-06 20:30:32 CEST

(In reply to Arvid Requate from comment #0)
> The new openssl release 1.0.2h fixes these issues:
> […]
> * EBCDIC overread (CVE-2016-2176)
- openssl <not-affected> (Only applies to EBCDIC systems)

Patches applied: 1.0.2d-1.118.201605062014
Advisory: openssl.yaml

Comment 4 Arvid Requate

2016-05-09 17:26:09 CEST

Verified:
* Patches Ok and applied
* Package updatable (amd64)
* Advisory ok

Comment 5 Philipp Hahn

2016-05-11 17:13:51 CEST

<http://errata.software-univention.de/ucs/4.1/176.html>