CVE-2018-0739

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

• fix CVE-2021-3712 - handling ASN.1 string as NULL terminated leads to read buffer overrun
• Port patches from oracle6els branch, original changelog entry:
• Oracle bug 28730228: backport CVE-2018-0732
• Oracle bug 28758493: backport CVE-2018-0737
• Merge upstream patch to fix CVE-2018-0739
• Avoid out-of-bounds read. Fixes CVE 2017-3735. By Rich Salz
• sha256 is used for the RSA pairwise consistency test instead of sha1

• fix CVE-2021-3712 - handling ASN.1 string as NULL terminated leads to read buffer overrun
• Port patches from oracle6els branch, original changelog entry:
• Oracle bug 28730228: backport CVE-2018-0732
• Oracle bug 28758493: backport CVE-2018-0737
• Merge upstream patch to fix CVE-2018-0739
• Avoid out-of-bounds read. Fixes CVE 2017-3735. By Rich Salz
• sha256 is used for the RSA pairwise consistency test instead of sha1

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe (CVE-2018-0739).

This update provides virtualbox 5.2.12 and fixes the following security issues:

Unauthorized remote attacker may have caused a hang or frequently repeatable crash (complete DOS) (CVE-2018-0739).

Attacker with host login may have compromised Virtualbox or further system services after interaction with a third user (CVE-2018-2830).

Attacker with host login may have compromised VirtualBox or further system services, allowing read access to some data (CVE-2018-2831).

Attacker with host login may have gained control over VirtualBox and possibly further system services after interacting with a third user (CVE-2018-2835, CVE-2018-2836, CVE-2018-2837, CVE-2018-2842, CVE-2018-2843, CVE-2018-2844).

Attacker with host login may have caused a hang or frequently repeatable crash (complete DOS), and perform unauthorized read and write operation to some VirtualBox accessible data (CVE-2018-2845).

Privileged attacker may have gained control over VirtualBox and possibly further system services (CVE-2018-2860).

For other fixes in this update, see the referenced changelog

libtomcrypt has been updated to secure it against two security vulnerabilities.

A problem in the ASN.1 parser could cause a stack overflow and a resulting denial of service when parsing deeply recursive ASN.1 types (CVE-2018-0739).

An attacker capable of triggering signatures and mounting a side channel attack against a victim can extract an ECDSA key in a practical amount of time (CVE-2018-12437).

These are all security issues fixed in the libtomcrypt-devel-1.18.2-2.10 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libopenssl-1_0_0-devel-1.0.2u-6.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ovmf-202105-3.4 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python3-virtualbox-6.1.26-3.2 package on the GA media of openSUSE Tumbleweed.

This feature update for venv-salt-minion provides the following changes:

• Introduce venv-salt-minion.
• Mention fixed issues provided with the bundle.

This update for openssl fixes the following issues:

• CVE-2018-0739: Constructed ASN.1 types with a recursive definition could exceed the stack. This could result in a Denial Of Service attack. (bsc#1087102)

This update for openssl1 fixes the following issues:

• CVE-2018-0739: Constructed ASN.1 types with a recursive definition could exceed the stack. This could result in a Denial Of Service attack. (bsc#1087102)

This update for openssl fixes the following issues:

• CVE-2018-0739: Constructed ASN.1 types with a recursive definition could exceed the stack. This could result in a Denial Of Service attack. (bsc#1087102)

This update for openssl fixes the following issues:

- CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) 
could eventually exceed the stack given malicious input with excessive recursion. This could result 
in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from 
untrusted sources so this is considered safe. (bsc#1087102).

This update for openssl fixes the following issues:

• CVE-2018-0739: Constructed ASN.1 types with a recursive definition could exceed the stack. This could result in a Denial Of Service attack. (bsc#1087102)

This update for ovmf fixes the following issues:

Security issues fixed:

• CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth (bsc#1094289).

This update for ovmf provide the following fix:

Security issues fixed:

• CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth (bsc#1094290, bsc#1094291).

Bug fixes:

• Only use SLES-UEFI-CA-Certificate-2048.crt for the SUSE flavor to provide the better compatibility. (bsc#1077330)

This update for compat-openssl097g fixes the following issues:

These security issues were fixed:

• CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158)
• CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could have resulted in DoS (bsc#1087102)

This non-security issue was fixed:

• Fixed crash in DES_fcrypt (bsc#1065363)

This update for compat-openssl098 fixes the following security issues:

• CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server could have sent a very large prime value to the client. This caused the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack (bsc#1097158)
• Blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)
• CVE-2018-0737: The RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could have recovered the private key (bsc#1089039)
• CVE-2018-0739: Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could have resulted in DoS (bsc#1087102).

This update for ovmf fixes the following issues:

Security issues fixed:

• CVE-2018-0739: Update openssl to 1.0.2o to limit ASN.1 constructed types recursive definition depth (bsc#1094291).
• CVE-2019-14563: Fixed a memory corruption caused by insufficient numeric truncation (bsc#1163959).
• CVE-2019-14559: Fixed a remotely exploitable memory leak in the ARP handling code (bsc#1163927).
• CVE-2019-14575: Fixed an insufficient signature check in the DxeImageVerificationHandler (bsc#1163969).

Bug fixes:

• Only use SLES-UEFI-CA-Certificate-2048.crt for the SUSE flavor to provide the better compatibility. (bsc#1077330)

It was discovered that OpenSSL incorrectly handled certain ASN.1 types. A remote attacker could possibly use this issue to cause a denial of service.