Bug 41225

Summary:	openssl: multiple issues (3.2)
Product:	UCS	Reporter:	Arvid Requate <requate>
Component:	Security updates	Assignee:	Janek Walkenhorst <walkenhorst>
Status:	CLOSED FIXED	QA Contact:	Arvid Requate <requate>
Severity:	normal
Priority:	P4	CC:	gohmann, hahn, requate, walkenhorst
Version:	UCS 3.2	Flags:	requate: Patch_Available+
Target Milestone:	UCS 3.2-8-errata
Hardware:	Other
OS:	Linux
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):	Security
Max CVSS v3 score:
Attachments:	patches-for-openssl-0.9.8o-4squeeze23.tar.gz patches-for-openssl-0.9.8o-4squeeze23.tar.gz

Description Arvid Requate

2016-05-09 18:27:58 CEST

Created attachment 7645 [details]
patches-for-openssl-0.9.8o-4squeeze23.tar.gz

The attached tgz contains backported patches for

* EVP_EncodeUpdate overflow (CVE-2016-2105)
* EVP_EncryptUpdate overflow (CVE-2016-2106)
* Memory corruption in the ASN.1 encoder (CVE-2016-2108)
* ASN.1 BIO excessive memory allocation (CVE-2016-2109)

The code affected by CVE-2016-2107 is not present in OpenSSL 0.9.8

+++ This bug was initially created as a clone of Bug #41198 +++

Comment 1 Arvid Requate

2016-05-10 21:37:29 CEST

Created attachment 7650 [details]
patches-for-openssl-0.9.8o-4squeeze23.tar.gz

Updated patch bundle, the other one was incomplete.

Comment 2 Janek Walkenhorst

2016-05-17 19:42:27 CEST

(In reply to Arvid Requate from comment #1)
> Created attachment 7650 [details]
> patches-for-openssl-0.9.8o-4squeeze23.tar.gz
> 
> Updated patch bundle, the other one was incomplete.
Removed duplicate " {" from CVE-2016-2105.patch
Otherwise they are good.

Comment 3 Janek Walkenhorst

2016-05-20 10:38:28 CEST

Tests (i386): OK
Advisory: openssl.yaml

Comment 4 Arvid Requate

2016-05-31 17:42:21 CEST

Verified:

* Source patches ok and applied
* Binary packages updatable
* Advisory: Ok

Comment 5 Janek Walkenhorst

2016-06-01 16:12:09 CEST

<http://errata.software-univention.de/ucs/3.2/426.html>