Security update for OpenSSL

SUSE Security Update: Security update for OpenSSL
Announcement ID: SUSE-SU-2014:1386-1
Rating: important
References: #892403 #901223 #901277
Affected Products:
  • SUSE Linux Enterprise Server 11 SP2 LTSS
  • SUSE Linux Enterprise Server 11 SP1 LTSS
    		•

    An update that fixes four vulnerabilities is now available. It includes one version update.

    Description:


    This OpenSSL update fixes the following issues:

    * Session Ticket Memory Leak (CVE-2014-3567)
    * Build option no-ssl3 is incomplete ((CVE-2014-3568)
    * Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

    Security Issues:

    * CVE-2014-3513

    * CVE-2014-3567

    * CVE-2014-3566

    * CVE-2014-3568

    Indications:

    Everybody should update.

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • SUSE Linux Enterprise Server 11 SP2 LTSS:
      zypper in -t patch slessp2-libopenssl-devel-9928
    • SUSE Linux Enterprise Server 11 SP1 LTSS:
      zypper in -t patch slessp1-libopenssl-devel-9927

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • SUSE Linux Enterprise Server 11 SP2 LTSS (i586 s390x x86_64):
      • libopenssl-devel-0.9.8j-0.66.1
      • libopenssl0_9_8-0.9.8j-0.66.1
      • libopenssl0_9_8-hmac-0.9.8j-0.66.1
      • openssl-0.9.8j-0.66.1
      • openssl-doc-0.9.8j-0.66.1
    • SUSE Linux Enterprise Server 11 SP2 LTSS (s390x x86_64):
      • libopenssl0_9_8-32bit-0.9.8j-0.66.1
      • libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1
    • SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64) [New Version: 0.9.8j]:
      • libopenssl-devel-0.9.8j-0.66.1
      • libopenssl0_9_8-0.9.8j-0.66.1
      • libopenssl0_9_8-hmac-0.9.8j-0.66.1
      • openssl-0.9.8j-0.66.1
      • openssl-doc-0.9.8j-0.66.1
    • SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64) [New Version: 0.9.8j]:
      • libopenssl0_9_8-32bit-0.9.8j-0.66.1
      • libopenssl0_9_8-hmac-32bit-0.9.8j-0.66.1

    References:

    • http://support.novell.com/security/cve/CVE-2014-3513.html
    • http://support.novell.com/security/cve/CVE-2014-3566.html
    • http://support.novell.com/security/cve/CVE-2014-3567.html
    • http://support.novell.com/security/cve/CVE-2014-3568.html
    • https://bugzilla.suse.com/show_bug.cgi?id=892403
    • https://bugzilla.suse.com/show_bug.cgi?id=901223
    • https://bugzilla.suse.com/show_bug.cgi?id=901277
    • http://download.suse.com/patch/finder/?keywords=842997f20dc51405dbd07abdc8071460
    • http://download.suse.com/patch/finder/?keywords=8b3e46d68e087bc1f9f9870abd2b6d0d