From 4f2d7949f03e1c198bc888f2d05f421d35c57e21 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Mon, 9 Oct 2017 18:53:29 +0100 Subject: reinit the tree, so we can have metadata --- metadata/glsa/glsa-201203-12.xml | 108 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 108 insertions(+) create mode 100644 metadata/glsa/glsa-201203-12.xml (limited to 'metadata/glsa/glsa-201203-12.xml') diff --git a/metadata/glsa/glsa-201203-12.xml b/metadata/glsa/glsa-201203-12.xml new file mode 100644 index 000000000000..2f7a231081cc --- /dev/null +++ b/metadata/glsa/glsa-201203-12.xml @@ -0,0 +1,108 @@ + + + + OpenSSL: Multiple vulnerabilities + Multiple vulnerabilities have been found in OpenSSL, allowing + remote attackers to cause a Denial of Service or obtain sensitive + information. + + openssl + 2012-03-06 + 2015-06-06: 9 + 397695 + 399365 + remote + + + 1.0.0g + 0.9.8t + 0.9.8u + 0.9.8v + 0.9.8w + 0.9.8x + 0.9.8y + 0.9.8z_p1 + 0.9.8z_p2 + 0.9.8z_p3 + 0.9.8z_p4 + 0.9.8z_p5 + 0.9.8z_p6 + 0.9.8z_p7 + 0.9.8z_p8 + 0.9.8z_p9 + 0.9.8z_p10 + 0.9.8z_p11 + 0.9.8z_p12 + 0.9.8z_p13 + 0.9.8z_p14 + 0.9.8z_p15 + 1.0.0g + + + +

OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer + (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general + purpose cryptography library. +

+ + +

Multiple vulnerabilities have been found in OpenSSL:

+ +
    +
  • Timing differences for decryption are exposed by CBC mode encryption + in OpenSSL’s implementation of DTLS (CVE-2011-4108). +
    • +
  • A policy check failure can result in a double-free error when + X509_V_FLAG_POLICY_CHECK is set (CVE-2011-4109). +
    • +
  • Clients and servers using SSL 3.0 handshakes do not clear the block + cipher padding, allowing a record to contain up to 15 bytes of + uninitialized memory, which could include sensitive information + (CVE-2011-4576). +
    • +
  • Assertion errors can occur during the handling of malformed X.509 + certificates when OpenSSL is built with RFC 3779 support + (CVE-2011-4577). +
    • +
  • A resource management error can occur when OpenSSL’s server gated + cryptography (SGC) does not properly handle handshake restarts + (CVE-2011-4619). +
    • +
  • Invalid parameters in the GOST block cipher are not properly handled + by the GOST ENGINE(CVE-2012-0027). +
    • +
  • An incorrect fix for CVE-2011-4108 creates an unspecified + vulnerability for DTLS applications using OpenSSL (CVE-2012-0050). +
    • +
+ + +

A remote attacker may be able to cause a Denial of Service or obtain + sensitive information, including plaintext passwords. +

+ + +

There is no known workaround at this time.

+ + +

All OpenSSL users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=dev-libs/openssl-1.0.0g" + + + + CVE-2011-4108 + CVE-2011-4109 + CVE-2011-4576 + CVE-2011-4577 + CVE-2011-4619 + CVE-2012-0027 + + CVE-2012-0050 + + + ago + ackle + -- cgit v1.2.3