May 2022 - Epel-packagers-sig - Fedora mailing-lists

[Bug 2087911] CVE-2022-1343 openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS
by bugzilla＠redhat.com 24 May '22

24 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087911 --- Doc Text *updated* by Todd Cullum <tcullum(a)redhat.com> --- There is a flaw in openssl's Online Certificate Status Protocol (OCSP) response functionality, in the signer certificate verification routines. This flaw could result in a linked application falsely believing that a x.509 Digital Certificate is either "good" or "unknown" when it has actually been revoked. This flaw requires that the application use a non-default configuration and exploitation of this flaw could result in impact to data integrity and/or confidentiality. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087911

1 0

[Bug 2087911] CVE-2022-1343 openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS
by bugzilla＠redhat.com 24 May '22

24 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087911 --- Comment #3 from Todd Cullum <tcullum(a)redhat.com> --- I dropped the severity to Moderate because the OCSP_NOCHECKS is not default, not expected to be commonly used, and also there is still an indication of failure at the CLI for the oscp application. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087911

1 0

[Bug 2087911] CVE-2022-1343 openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS
by bugzilla＠redhat.com 24 May '22

24 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087911 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|high |medium Priority|high |medium -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087911

1 0

[Bug 2087912] CVE-2022-1434 openssl: Incorrect MAC key used in the RC4-MD5 ciphersuite
by bugzilla＠redhat.com 23 May '22

23 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087912 jajeon(a)redhat.com changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |jajeon(a)redhat.com -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087912

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 23 May '22

23 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 --- Comment #2 from Todd Cullum <tcullum(a)redhat.com> --- Created openssl3 tracking bugs for this issue: Affects: epel-8 [bug 2089474] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 23 May '22

23 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087913 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2089474 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2089474 [Bug 2089474] CVE-2022-1473 openssl3: openssl: OPENSSL_LH_flush() breaks reuse of memory [epel-8] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087913

1 0

[Bug 2087911] CVE-2022-1343 openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS
by bugzilla＠redhat.com 23 May '22

23 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087911 --- Comment #2 from Todd Cullum <tcullum(a)redhat.com> --- Created openssl3 tracking bugs for this issue: Affects: epel-8 [bug 2089472] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087911

1 0

[Bug 2087911] CVE-2022-1343 openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS
by bugzilla＠redhat.com 23 May '22

23 May '22

https://bugzilla.redhat.com/show_bug.cgi?id=2087911 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2089472 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2089472 [Bug 2089472] CVE-2022-1343 openssl3: openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS [epel-8] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2087911

1 0

[Bug 2087912] CVE-2022-1434 openssl: Incorrect MAC key used in the RC4-MD5 ciphersuite
by bugzilla＠redhat.com 23 May '22

23 May '22

1 0

[Bug 2087913] CVE-2022-1473 openssl: OPENSSL_LH_flush() breaks reuse of memory
by bugzilla＠redhat.com 23 May '22

23 May '22

1 0

2024

2023

2022

2021

Epel-packagers-sig May 2022