Bugzilla – Bug 1189521
VUL-0: CVE-2021-3712: openssl,openssl1,openssl-1_0_0,openssl-1_1,compat-openssl098: Read buffer overrun in X509_aux_print()
Last modified: 2022-11-29 15:06:52 UTC
is in public git already, just not associated with CVE: https://github.com/openssl/openssl/commit/d9d838ddc0ed083fb4c26dd067e71aad7c65ad16 (still keep embargoed!)
Maintenance requests created: | openssl-1_1 | | | | | SUSE:SLE-12-SP4:Update | request id 248531 | | | SUSE:SLE-15-SP1:Update | request id 248550 | | | SUSE:SLE-15:Update | request id 248549 | | | SUSE:SLE-15-SP2:Update | request id 248530 | | openssl-1_0_0 | | | | | SUSE:SLE-12-SP4:Update | request id 248537 | | | SUSE:SLE-15:Update | request id 248538 | | openssl | | | | | SUSE:SLE-12-SP2 | request id 248569 | | | SUSE:SLE-11-SP1 | request id 248626 | | openssl1 | | | | | SUSE:SLE-11-SP3 | request id 248570 | | compat-openssl098 | | | | | SUSE:SLE-12 | request id 248621 |
Created attachment 851998 [details] openssl-CVE-2021-3712.tar.bz2 updated pull request content. likely the final one for todays merge
is public https://www.openssl.org/news/secadv/20210824.txt Read buffer overruns processing ASN.1 strings (CVE-2021-3712) ============================================================= Severity: Moderate ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). OpenSSL versions 1.1.1k and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1l. OpenSSL versions 1.0.2y and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2za. Other users should upgrade to 1.1.1l. An initial instance of this issue in the X509_aux_print() function was reported to OpenSSL on 18th July 2021 by Ingo Schwarze. The bugfix was developed by Ingo Schwarze and first publicly released in OpenBSD-current on 10th July 2021 and subsequently in OpenSSL on 20th July 2021 (commit d9d838ddc). Subsequent analysis by David Benjamin on 17th August 2021 identified more instances of the same bug. Additional analysis was performed by Matt Caswell. Fixes for the additional instances of this issue were developed by Matt Caswell.
# maintenance_jira_update_notice SUSE-SU-2021:14791-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): openssl-0.9.8j-0.106.40.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): openssl-0.9.8j-0.106.40.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): openssl-0.9.8j-0.106.40.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): openssl-0.9.8j-0.106.40.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice openSUSE-SU-2021:2830-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1189520,1189521 CVE References: CVE-2021-3711,CVE-2021-3712 JIRA References: Sources used: openSUSE Leap 15.3 (src): openssl-1_1-1.1.1d-11.27.1
# maintenance_jira_update_notice SUSE-SU-2021:2831-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Manager Server 4.0 (src): openssl-1_1-1.1.0i-14.18.1 SUSE Manager Retail Branch Server 4.0 (src): openssl-1_1-1.1.0i-14.18.1 SUSE Manager Proxy 4.0 (src): openssl-1_1-1.1.0i-14.18.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): openssl-1_1-1.1.0i-14.18.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): openssl-1_1-1.1.0i-14.18.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): openssl-1_1-1.1.0i-14.18.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): openssl-1_1-1.1.0i-14.18.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): openssl-1_1-1.1.0i-14.18.1 SUSE Enterprise Storage 6 (src): openssl-1_1-1.1.0i-14.18.1 SUSE CaaS Platform 4.0 (src): openssl-1_1-1.1.0i-14.18.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2830-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1189520,1189521 CVE References: CVE-2021-3711,CVE-2021-3712 JIRA References: Sources used: SUSE MicroOS 5.0 (src): openssl-1_1-1.1.1d-11.27.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): openssl-1_1-1.1.1d-11.27.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): openssl-1_1-1.1.1d-11.27.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2825-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): openssl-1.0.2j-60.69.3 SUSE OpenStack Cloud 8 (src): openssl-1.0.2j-60.69.3 SUSE Linux Enterprise Server for SAP 12-SP3 (src): openssl-1.0.2j-60.69.3 SUSE Linux Enterprise Server 12-SP3-LTSS (src): openssl-1.0.2j-60.69.3 SUSE Linux Enterprise Server 12-SP3-BCL (src): openssl-1.0.2j-60.69.3 SUSE Linux Enterprise Server 12-SP2-BCL (src): openssl-1.0.2j-60.69.3 HPE Helion Openstack 8 (src): openssl-1.0.2j-60.69.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice openSUSE-SU-2021:2827-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: openSUSE Leap 15.3 (src): openssl-1_0_0-1.0.2p-3.40.2
# maintenance_jira_update_notice SUSE-SU-2021:2829-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): openssl-1_1-1.1.0i-4.60.1 SUSE Linux Enterprise Server 15-LTSS (src): openssl-1_1-1.1.0i-4.60.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): openssl-1_1-1.1.0i-4.60.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): openssl-1_1-1.1.0i-4.60.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2827-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Manager Server 4.0 (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Manager Retail Branch Server 4.0 (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Manager Proxy 4.0 (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Linux Enterprise Server for SAP 15-SP1 (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Linux Enterprise Server for SAP 15 (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Linux Enterprise Server 15-SP1-LTSS (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Linux Enterprise Server 15-SP1-BCL (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Linux Enterprise Server 15-LTSS (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Linux Enterprise Module for Legacy Software 15-SP2 (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE Enterprise Storage 6 (src): openssl-1_0_0-1.0.2p-3.40.2 SUSE CaaS Platform 4.0 (src): openssl-1_0_0-1.0.2p-3.40.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2826-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): openssl-1_0_0-1.0.2p-3.39.3 SUSE OpenStack Cloud 9 (src): openssl-1_0_0-1.0.2p-3.39.3 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): openssl-1_0_0-1.0.2p-3.39.3 SUSE Linux Enterprise Server for SAP 12-SP4 (src): openssl-1_0_0-1.0.2p-3.39.3 SUSE Linux Enterprise Server 12-SP5 (src): openssl-1_0_0-1.0.2p-3.39.3 SUSE Linux Enterprise Server 12-SP4-LTSS (src): openssl-1_0_0-1.0.2p-3.39.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2833-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1189520,1189521 CVE References: CVE-2021-3711,CVE-2021-3712 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): openssl-1_1-1.1.1d-2.36.2 SUSE OpenStack Cloud 9 (src): openssl-1_1-1.1.1d-2.36.2 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): openssl-1_1-1.1.1d-2.36.2 SUSE Linux Enterprise Server for SAP 12-SP4 (src): openssl-1_1-1.1.1d-2.36.2 SUSE Linux Enterprise Server 12-SP5 (src): openssl-1_1-1.1.1d-2.36.2 SUSE Linux Enterprise Server 12-SP4-LTSS (src): openssl-1_1-1.1.1d-2.36.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:14792-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SECURITY (src): openssl1-1.0.1g-0.58.36.2 SUSE Linux Enterprise Debuginfo 11-SP3 (src): openssl1-1.0.1g-0.58.36.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice openSUSE-SU-2021:1188-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1189520,1189521 CVE References: CVE-2021-3711,CVE-2021-3712 JIRA References: Sources used: openSUSE Leap 15.2 (src): openssl-1_1-1.1.1d-lp152.7.21.1
# maintenance_jira_update_notice openSUSE-SU-2021:1189-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: openSUSE Leap 15.2 (src): openssl-1_0_0-1.0.2p-lp152.8.15.1
# maintenance_jira_update_notice SUSE-SU-2021:2852-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 12-SP5 (src): compat-openssl098-0.9.8j-106.27.2 SUSE Linux Enterprise Server for SAP 12-SP4 (src): compat-openssl098-0.9.8j-106.27.2 SUSE Linux Enterprise Server for SAP 12-SP3 (src): compat-openssl098-0.9.8j-106.27.2 SUSE Linux Enterprise Module for Legacy Software 12 (src): compat-openssl098-0.9.8j-106.27.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
(In reply to Marcus Meissner from comment #15) > Created attachment 851998 [details] > openssl-CVE-2021-3712.tar.bz2 > > updated pull request content. likely the final one for todays merge Created a bunch of maintenance requests: | project | stream | CVE-2021-3712 | |-------------------+------------------------+----------------------------| | openssl-1_1 | | | | | SUSE:SLE-12-SP4:Update | request id 249059 | | | SUSE:SLE-15-SP1:Update | request id 249060 | | | SUSE:SLE-15:Update | request id 249061 | | | SUSE:SLE-15-SP2:Update | request id 249062 | | | FACTORY | fixed by upgrade to 1.1.1l | | openssl-1_0_0 | | | | | SUSE:SLE-12-SP4:Update | request id 249063 | | | SUSE:SLE-15:Update | request id 249064 | | | FACTORY | request id 915323 | | openssl | | | | | SUSE:SLE-12-SP2 | request id 249066 | | | SUSE:SLE-11-SP1 | request id 249065 | | openssl1 | | | | | SUSE:SLE-11-SP3 | request id 249068 | | compat-openssl098 | | | | | SUSE:SLE-12 | request id 249067 | | | | |
This will keep coming back unless you.. diff --git a/include/openssl/asn1.h b/include/openssl/asn1.h index 9522eec18f..9744957f4c 100644 --- a/include/openssl/asn1.h +++ b/include/openssl/asn1.h @@ -146,7 +146,7 @@ DEFINE_STACK_OF(X509_ALGOR) struct asn1_string_st { int length; int type; - unsigned char *data; + unsigned char *data __attribute__ ((nonstring)); and of course, fix at least one use of strlen in the source code even if it ma be a false positive. (strlen on non null terminated is UB)
# maintenance_jira_update_notice openSUSE-SU-2021:2966-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: openSUSE Leap 15.3 (src): openssl-1_1-1.1.1d-11.30.1
# maintenance_jira_update_notice SUSE-SU-2021:2968-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): openssl-1_1-1.1.0i-14.21.2 SUSE Linux Enterprise Server 15-SP1-LTSS (src): openssl-1_1-1.1.0i-14.21.2 SUSE Linux Enterprise Server 15-SP1-BCL (src): openssl-1_1-1.1.0i-14.21.2 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): openssl-1_1-1.1.0i-14.21.2 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): openssl-1_1-1.1.0i-14.21.2 SUSE Enterprise Storage 6 (src): openssl-1_1-1.1.0i-14.21.2 SUSE CaaS Platform 4.0 (src): openssl-1_1-1.1.0i-14.21.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2967-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): openssl-1_1-1.1.0i-4.63.1 SUSE Linux Enterprise Server 15-LTSS (src): openssl-1_1-1.1.0i-4.63.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): openssl-1_1-1.1.0i-4.63.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): openssl-1_1-1.1.0i-4.63.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2966-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE MicroOS 5.0 (src): openssl-1_1-1.1.1d-11.30.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): openssl-1_1-1.1.1d-11.30.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): openssl-1_1-1.1.1d-11.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2995-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): openssl-1_0_0-1.0.2p-3.42.2 SUSE OpenStack Cloud 9 (src): openssl-1_0_0-1.0.2p-3.42.2 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): openssl-1_0_0-1.0.2p-3.42.2 SUSE Linux Enterprise Server for SAP 12-SP4 (src): openssl-1_0_0-1.0.2p-3.42.2 SUSE Linux Enterprise Server 12-SP5 (src): openssl-1_0_0-1.0.2p-3.42.2 SUSE Linux Enterprise Server 12-SP4-LTSS (src): openssl-1_0_0-1.0.2p-3.42.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2996-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): openssl-1_1-1.1.1d-2.39.2 SUSE OpenStack Cloud 9 (src): openssl-1_1-1.1.1d-2.39.2 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): openssl-1_1-1.1.1d-2.39.2 SUSE Linux Enterprise Server for SAP 12-SP4 (src): openssl-1_1-1.1.1d-2.39.2 SUSE Linux Enterprise Server 12-SP5 (src): openssl-1_1-1.1.1d-2.39.2 SUSE Linux Enterprise Server 12-SP4-LTSS (src): openssl-1_1-1.1.1d-2.39.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice openSUSE-SU-2021:2994-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: openSUSE Leap 15.3 (src): openssl-1_0_0-1.0.2p-3.43.1
# maintenance_jira_update_notice SUSE-SU-2021:2994-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): openssl-1_0_0-1.0.2p-3.43.1 SUSE Linux Enterprise Server for SAP 15 (src): openssl-1_0_0-1.0.2p-3.43.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): openssl-1_0_0-1.0.2p-3.43.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): openssl-1_0_0-1.0.2p-3.43.1 SUSE Linux Enterprise Server 15-LTSS (src): openssl-1_0_0-1.0.2p-3.43.1 SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src): openssl-1_0_0-1.0.2p-3.43.1 SUSE Linux Enterprise Module for Legacy Software 15-SP2 (src): openssl-1_0_0-1.0.2p-3.43.1 SUSE Enterprise Storage 6 (src): openssl-1_0_0-1.0.2p-3.43.1 SUSE CaaS Platform 4.0 (src): openssl-1_0_0-1.0.2p-3.43.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice openSUSE-SU-2021:1248-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: openSUSE Leap 15.2 (src): openssl-1_1-1.1.1d-lp152.7.24.1
# maintenance_jira_update_notice SUSE-SU-2021:3019-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 12-SP5 (src): compat-openssl098-0.9.8j-106.30.2 SUSE Linux Enterprise Server for SAP 12-SP4 (src): compat-openssl098-0.9.8j-106.30.2 SUSE Linux Enterprise Server for SAP 12-SP3 (src): compat-openssl098-0.9.8j-106.30.2 SUSE Linux Enterprise Module for Legacy Software 12 (src): compat-openssl098-0.9.8j-106.30.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice openSUSE-SU-2021:1261-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: openSUSE Leap 15.2 (src): openssl-1_0_0-1.0.2p-lp152.8.18.1
# maintenance_jira_update_notice SUSE-SU-2021:14802-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): openssl-0.9.8j-0.106.43.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): openssl-0.9.8j-0.106.43.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): openssl-0.9.8j-0.106.43.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): openssl-0.9.8j-0.106.43.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:14801-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SECURITY (src): openssl1-1.0.1g-0.58.39.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): openssl1-1.0.1g-0.58.39.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:3144-1: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 8 (src): openssl-1.0.2j-60.72.2 SUSE OpenStack Cloud 8 (src): openssl-1.0.2j-60.72.2 SUSE Linux Enterprise Server for SAP 12-SP3 (src): openssl-1.0.2j-60.72.2 SUSE Linux Enterprise Server 12-SP3-LTSS (src): openssl-1.0.2j-60.72.2 SUSE Linux Enterprise Server 12-SP3-BCL (src): openssl-1.0.2j-60.72.2 SUSE Linux Enterprise Server 12-SP2-BCL (src): openssl-1.0.2j-60.72.2 HPE Helion Openstack 8 (src): openssl-1.0.2j-60.72.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
# maintenance_jira_update_notice SUSE-SU-2021:2966-2: An update that fixes one vulnerability is now available. Category: security (low) Bug References: 1189521 CVE References: CVE-2021-3712 JIRA References: Sources used: SUSE MicroOS 5.1 (src): openssl-1_1-1.1.1d-11.30.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-FU-2022:0445-1: An update that solves 183 vulnerabilities, contains 21 features and has 299 fixes is now available. Category: feature (moderate) Bug References: 1000080,1000117,1000194,1000677,1000742,1001148,1001912,1002585,1002895,1003091,1005246,1009528,1010874,1010966,1011936,1015549,1019637,1021641,1022085,1022086,1022271,1027079,1027610,1027688,1027705,1027908,1028281,1028723,1029523,1029902,1030038,1032118,1032119,1035604,1039469,1040164,1040256,1041090,1042392,1042670,1044095,1044107,1044175,1049186,1049304,1050653,1050665,1055478,1055542,1055825,1056058,1056951,1057496,1062237,1065363,1066242,1066873,1068790,1070737,1070738,1070853,1071905,1071906,1071941,1073310,1073845,1073879,1074247,1076519,1077096,1077230,1078329,1079761,1080301,1081005,1081750,1081751,1082155,1082163,1082318,1083826,1084117,1084157,1085276,1085529,1085661,1087102,1087104,1088573,1089039,1090427,1090765,1090953,1093518,1093917,1094788,1094814,1094883,1095267,1096738,1096937,1097158,1097531,1097624,1098535,1098592,1099308,1099569,1100078,1101246,1101470,1102868,1104789,1106197,1108508,1109882,1109998,1110435,1110869,1110871,1111493,1111622,1111657,1112209,1112357,1113534,1113652,1113742,1113975,1115769,1117951,1118611,1119376,1119416,1119792,1121717,1121852,1122191,1123064,1123185,1123186,1123558,1124885,1125815,1126283,1126318,1127080,1127173,1128146,1128323,1128355,1129071,1129566,1130840,1131291,1132174,1132323,1132455,1132663,1132900,1135009,1136444,1138666,1138715,1138746,1139915,1140255,1141168,1142899,1143033,1143454,1143893,1144506,1149686,1149792,1150003,1150190,1150250,1150895,1153830,1155815,1156677,1156694,1156908,1157104,1157354,1158809,1159235,1159538,1160163,1161557,1161770,1162224,1162367,1162743,1163978,1164310,1165439,1165578,1165730,1165823,1165960,1166139,1166758,1167008,1167501,1167732,1167746,1168480,1168973,1169489,1170175,1170863,1171368,1171561,1172226,1172908,1172928,1173226,1173356,1174009,1174091,1174514,1175729,1176116,1176129,1176134,1176232,1176256,1176257,1176258,1176259,1176262,1176389,1176785,1176977,1177120,1177127,1177559,1178168,1178341,1178670,1179491,1179562,1179630,1179805,1180125,1180781,1181126,1181324,1181944,1182066,1182211,1182244,1182264,1182331,1182333,1182379,1182963,1183059,1183374,1183858,1184505,1185588,1185706,1185748,1186738,1187045,1189521,1190781,1193357,356549,381844,394317,408865,428177,430141,431945,437293,442740,459468,489641,504687,509031,526319,590833,610223,610642,629905,637176,651003,657698,658604,670526,673071,693027,715423,720601,743787,747125,748738,749210,749213,749735,750618,751718,751946,751977,754447,754677,761500,774710,784670,784994,787526,793420,799119,802184,803004,809831,811890,822642,825221,828513,831629,832833,834601,835687,839107,84331,849377,855666,855676,856687,857203,857850,858239,867887,869945,871152,872299,873351,876282,876710,876712,876748,880891,885662,885882,889013,889363,892477,892480,895129,898917,901223,901277,901902,902364,906878,907584,908362,908372,912014,912015,912018,912292,912293,912294,912296,912460,913229,915479,917607,917759,917815,919648,920236,922448,922488,922496,922499,922500,926597,929678,929736,930189,931698,931978,933898,933911,934487,934489,934491,934493,935856,937085,937212,937492,937634,937912,939456,940608,942385,942751,943421,944204,945455,946648,947104,947357,947679,948198,952871,954256,954486,954690,957812,957813,957815,958501,961334,962291,963415,963974,964204,964472,964474,965830,967128,968046,968047,968048,968050,968265,968270,968374,968601,975875,976942,977584,977614,977615,977616,977663,978224,981848,982268,982575,983249,984323,985054,988086,990207,990392,990419,990428,991193,991877,992120,992988,992989,992992,993130,993819,993825,993968,994749,994844,994910,995075,995324,995359,995377,995959,996255,997043,997614,998190,999665,999666,999668 CVE References: CVE-2006-2937,CVE-2006-2940,CVE-2006-3738,CVE-2006-4339,CVE-2006-4343,CVE-2006-7250,CVE-2007-3108,CVE-2007-4995,CVE-2007-5135,CVE-2008-0891,CVE-2008-1672,CVE-2008-5077,CVE-2009-0590,CVE-2009-0591,CVE-2009-0789,CVE-2009-1377,CVE-2009-1378,CVE-2009-1379,CVE-2009-1386,CVE-2009-1387,CVE-2010-0740,CVE-2010-0742,CVE-2010-1633,CVE-2010-2939,CVE-2010-3864,CVE-2010-5298,CVE-2011-0014,CVE-2011-3207,CVE-2011-3210,CVE-2011-3389,CVE-2011-4108,CVE-2011-4576,CVE-2011-4577,CVE-2011-4619,CVE-2011-4944,CVE-2012-0027,CVE-2012-0050,CVE-2012-0845,CVE-2012-0884,CVE-2012-1150,CVE-2012-1165,CVE-2012-2110,CVE-2012-2686,CVE-2012-4929,CVE-2013-0166,CVE-2013-0169,CVE-2013-1752,CVE-2013-4238,CVE-2013-4314,CVE-2013-4353,CVE-2013-6449,CVE-2013-6450,CVE-2014-0012,CVE-2014-0076,CVE-2014-0160,CVE-2014-0195,CVE-2014-0198,CVE-2014-0221,CVE-2014-0224,CVE-2014-1829,CVE-2014-1830,CVE-2014-2667,CVE-2014-3470,CVE-2014-3505,CVE-2014-3506,CVE-2014-3507,CVE-2014-3508,CVE-2014-3509,CVE-2014-3510,CVE-2014-3511,CVE-2014-3512,CVE-2014-3513,CVE-2014-3566,CVE-2014-3567,CVE-2014-3568,CVE-2014-3570,CVE-2014-3571,CVE-2014-3572,CVE-2014-4650,CVE-2014-5139,CVE-2014-7202,CVE-2014-7203,CVE-2014-8275,CVE-2014-9721,CVE-2015-0204,CVE-2015-0205,CVE-2015-0206,CVE-2015-0209,CVE-2015-0286,CVE-2015-0287,CVE-2015-0288,CVE-2015-0289,CVE-2015-0293,CVE-2015-1788,CVE-2015-1789,CVE-2015-1790,CVE-2015-1791,CVE-2015-1792,CVE-2015-2296,CVE-2015-3194,CVE-2015-3195,CVE-2015-3196,CVE-2015-3197,CVE-2015-3216,CVE-2015-4000,CVE-2016-0702,CVE-2016-0705,CVE-2016-0797,CVE-2016-0798,CVE-2016-0799,CVE-2016-0800,CVE-2016-10745,CVE-2016-2105,CVE-2016-2106,CVE-2016-2107,CVE-2016-2109,CVE-2016-2176,CVE-2016-2177,CVE-2016-2178,CVE-2016-2179,CVE-2016-2180,CVE-2016-2181,CVE-2016-2182,CVE-2016-2183,CVE-2016-6302,CVE-2016-6303,CVE-2016-6304,CVE-2016-6306,CVE-2016-7052,CVE-2016-7055,CVE-2016-9015,CVE-2017-18342,CVE-2017-3731,CVE-2017-3732,CVE-2017-3735,CVE-2017-3736,CVE-2017-3737,CVE-2017-3738,CVE-2018-0732,CVE-2018-0734,CVE-2018-0737,CVE-2018-0739,CVE-2018-18074,CVE-2018-20060,CVE-2018-5407,CVE-2018-7750,CVE-2019-10906,CVE-2019-11236,CVE-2019-11324,CVE-2019-13132,CVE-2019-1547,CVE-2019-1551,CVE-2019-1559,CVE-2019-1563,CVE-2019-20907,CVE-2019-20916,CVE-2019-5010,CVE-2019-6250,CVE-2019-8341,CVE-2019-9740,CVE-2019-9947,CVE-2020-14343,CVE-2020-15166,CVE-2020-15523,CVE-2020-15801,CVE-2020-1747,CVE-2020-1971,CVE-2020-25659,CVE-2020-26137,CVE-2020-27783,CVE-2020-28493,CVE-2020-29651,CVE-2020-36242,CVE-2020-8492,CVE-2021-23336,CVE-2021-23840,CVE-2021-23841,CVE-2021-28957,CVE-2021-29921,CVE-2021-3177,CVE-2021-33503,CVE-2021-3426,CVE-2021-3712 JIRA References: ECO-3105,SLE-11435,SLE-12684,SLE-12986,SLE-13688,SLE-14253,SLE-15159,SLE-15860,SLE-15861,SLE-16754,SLE-17532,SLE-17957,SLE-18260,SLE-18354,SLE-18446,SLE-19264,SLE-3887,SLE-4480,SLE-4577,SLE-7686,SLE-9135 Sources used: SUSE Manager Tools 12-BETA (src): venv-salt-minion-3002.2-3.3.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.