Upstream information

CVE-2012-2686 at MITRE


crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows remote attackers to cause a denial of service (application crash) via crafted CBC data.

SUSE information

CVSS v2 Scores
  National Vulnerability Database
Base Score 4.96
Vector AV:N/AC:L/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial

Note from the SUSE Security Team

The openssl versions in SUSE Linux Enterprise 11 and older are based on openssl 0.9.8 and do not support TLS 1.1 or 1.2 at this time. So SUSE Linux Enterprise 11 and older distributions are not affected by this security problem.

SUSE Bugzilla entry: 802648 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE Evergreen 11.4
  • libopenssl-devel >= 1.0.0k-18.45.1
  • libopenssl1_0_0 >= 1.0.0k-18.45.1
  • libopenssl1_0_0-32bit >= 1.0.0k-18.45.1
  • libopenssl1_0_0-debuginfo >= 1.0.0k-18.45.1
  • libopenssl1_0_0-debuginfo-32bit >= 1.0.0k-18.45.1
  • libopenssl1_0_0-debuginfo-x86 >= 1.0.0k-18.45.1
  • libopenssl1_0_0-x86 >= 1.0.0k-18.45.1
  • openssl >= 1.0.0k-18.45.1
  • openssl-debuginfo >= 1.0.0k-18.45.1
  • openssl-debugsource >= 1.0.0k-18.45.1
  • openssl-doc >= 1.0.0k-18.45.1