Re: git: 14798d61ba89 - main - security/vuxml: Add/update OpenSSL vulnerability
- In reply to: Bernard Spil : "git: 14798d61ba89 - main - security/vuxml: Add/update OpenSSL vulnerability"
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 05 Jul 2022 15:32:56 UTC
In message <202207051452.265EqWvF055331@gitrepo.freebsd.org>, Bernard Spil writ es: > The branch main has been updated by brnrd: > > URL: https://cgit.FreeBSD.org/ports/commit/?id=14798d61ba89013c033dfb5027635c > 0457db2dec > > commit 14798d61ba89013c033dfb5027635c0457db2dec > Author: Bernard Spil <brnrd@FreeBSD.org> > AuthorDate: 2022-07-05 14:51:47 +0000 > Commit: Bernard Spil <brnrd@FreeBSD.org> > CommitDate: 2022-07-05 14:51:47 +0000 > > security/vuxml: Add/update OpenSSL vulnerability > > * Update the RSA key AVX512 vuln to 3.0.4 only > * Add new AES OCB vuln in 1.1.1q/3.0.5 Reading the advisory myself it says, OpenSSL 1.1.1 and 1.0.2 are not affected by this issue. Is the advisory mistaken? > --- > security/vuxml/vuln-2022.xml | 58 ++++++++++++++++++++++++++++++++++++------ > -- > 1 file changed, 48 insertions(+), 10 deletions(-) > > diff --git a/security/vuxml/vuln-2022.xml b/security/vuxml/vuln-2022.xml > index c64fc8950f02..9a4f093ac4fb 100644 > --- a/security/vuxml/vuln-2022.xml > +++ b/security/vuxml/vuln-2022.xml > @@ -1,3 +1,37 @@ > + <vuln vid="a28e8b7e-fc70-11ec-856e-d4c9ef517024"> > + <topic>OpenSSL -- AES OCB fails to encrypt some bytes</topic> > + <affects> > + <package> > + <name>openssl</name> > + <range><lt>1.1.1q,1</lt></range> > + </package> > + <package> > + <name>openssl-devel</name> > + <range><lt>3.0.5</lt></range> > + </package> > + </affects> > + <description> > + <body xmlns="http://www.w3.org/1999/xhtml"> > + <p>The OpenSSL project reports:</p> > + <blockquote cite="https://www.openssl.org/news/secadv/20220705.txt"> > + <p>AES OCB mode for 32-bit x86 platforms using the AES-NI assembly op > timised > + implementation will not encrypt the entirety of the data under some > + circumstances. This could reveal sixteen bytes of data that was > + preexisting in the memory that wasn't written. In the special case > of > + "in place" encryption, sixteen bytes of the plaintext would be reve > aled.</p> > + </blockquote> > + </body> > + </description> > + <references> > + <cvename>CVE-2022-2097</cvename> > + <url>https://www.openssl.org/news/secadv/20220705.txt</url> > + </references> > + <dates> > + <discovery>2022-07-05</discovery> > + <entry>2022-07-05</entry> > + </dates> > + </vuln> > + > <vuln vid="5be19b0d-fb85-11ec-95cd-080027b24e86"> > <topic>Django -- multiple vulnerabilities</topic> > <affects> > @@ -35,34 +69,38 @@ > </vuln> > > <vuln vid="f0e45968-faff-11ec-856e-d4c9ef517024"> > - <topic>OpenSSL -- Bug in RSA implementation for AVX512IFMA</topic> > + <topic>OpenSSL -- Heap memory corruption with RSA private key operation< > /topic> > <affects> > - <package> > - <name>openssl</name> > - <range><lt>1.1.1q,1</lt></range> > - </package> > <package> > <name>openssl-devel</name> > - <range><lt>3.0.5</lt></range> > + <range><ge>3.0.4</ge><lt>3.0.5</lt></range> > </package> > </affects> > <description> > <body xmlns="http://www.w3.org/1999/xhtml"> > <p>The OpenSSL project reports:</p> > <blockquote cite="https://mta.openssl.org/pipermail/openssl-announce/20 > 22-July/000229.html"> > - <p>One of the issues fixed in the 3.0.5 release is the > - CVE-2022-2274 (Bug in RSA implementation for AVX512IFMA > - capable CPUs) which is already public</p> > + <p>The OpenSSL 3.0.4 release introduced a serious bug in the RSA > + implementation for X86_64 CPUs supporting the AVX512IFMA instructio > ns. > + This issue makes the RSA implementation with 2048 bit private keys > + incorrect on such machines and memory corruption will happen during > + the computation. As a consequence of the memory corruption an attac > ker > + may be able to trigger a remote code execution on the machine perfo > rming > + the computation.</p> > + <p>SSL/TLS servers or other servers using 2048 bit RSA private keys r > unning > + on machines supporting AVX512IFMA instructions of the X86_64 archit > ecture > + are affected by this issue.</p> > </blockquote> > </body> > </description> > <references> > <cvename>CVE-2022-2274</cvename> > - <url>https://mta.openssl.org/pipermail/openssl-announce/2022-July/0002 > 29.html</url> > + <url>https://www.openssl.org/news/secadv/20220705.txt</url> > </references> > <dates> > <discovery>2022-07-01</discovery> > <entry>2022-07-03</entry> > + <modified>2022-07-05</modified> > </dates> > </vuln> > >