CVE-2020-1967

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack.

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

This update for rust, rust-cbindgen fixes the following issues:

rust was updated for use by Firefox 76ESR.

• Fixed miscompilations with rustc 1.43 that lead to LTO failures (bsc#1173202)

Update to version 1.43.1

• Updated openssl-src to 1.1.1g for CVE-2020-1967.
• Fixed the stabilization of AVX-512 features.
• Fixed cargo package --list not working with unpublished dependencies.

Update to version 1.43.0

• Language:

• Fixed using binary operations with &{number} (e.g. &1.0) not having the type inferred correctly.
• Attributes such as #[cfg()] can now be used on if expressions.
• Syntax only changes:
  • Allow type Foo: Ord syntactically.
  • Fuse associated and extern items up to defaultness.
  • Syntactically allow self in all fn contexts.
  • Merge fn syntax + cleanup item parsing.
  • item macro fragments can be interpolated into traits, impls, and extern blocks. For example, you may now write:

    macro_rules! mac_trait {
      ($i:item) => {
          trait T { $i }
      }
    }
    mac_trait! {
        fn foo() {}
    }
    

  • These are still rejected semantically, so you will likely receive an error but these changes can be seen and parsed by macros and conditional compilation.

• Compiler

• You can now pass multiple lint flags to rustc to override the previous flags.

  For example; rustc -D unused -A unused-variables denies everything in the unused lint group except unused-variables which is explicitly allowed. However, passing rustc -A unused-variables -D unused denies everything in the unused lint group including unused-variables since the allow flag is specified before the deny flag (and therefore overridden).

• rustc will now prefer your system MinGW libraries over its bundled libraries if they are available on windows-gnu.

• rustc now buffers errors/warnings printed in JSON.

Libraries:

• Arc<[T; N]>, Box<[T; N]>, and Rc<[T; N]>, now implement TryFrom<Arc<[T]>>,TryFrom<Box<[T]>>, and TryFrom<Rc<[T]>> respectively. Note These conversions are only available when N is 0..=32.
• You can now use associated constants on floats and integers directly, rather than having to import the module. e.g. You can now write u32::MAX or f32::NAN with no imports.
• u8::is_ascii is now const.
• String now implements AsMut<str>.
• Added the primitive module to std and core. This module reexports Rust's primitive types. This is mainly useful in macros where you want avoid these types being shadowed.
• Relaxed some of the trait bounds on HashMap and HashSet.
• string::FromUtf8Error now implements Clone + Eq.

• Stabilized APIs

• Once::is_completed
• f32::LOG10_2
• f32::LOG2_10
• f64::LOG10_2
• f64::LOG2_10
• iter::once_with

• Cargo

  • You can now set config [profile]s in your .cargo/config, or through your environment.
  • Cargo will now set CARGO_BIN_EXE_<name> pointing to a binary's executable path when running integration tests or benchmarks. <name> is the name of your binary as-is e.g. If you wanted the executable path for a binary named my-programyou would use env!('CARGO_BIN_EXE_my-program').

• Misc

  • Certain checks in the const_err lint were deemed unrelated to const evaluation, and have been moved to the unconditional_panic and arithmetic_overflow lints.

• Compatibility Notes

  • Having trailing syntax in the assert! macro is now a hard error. This has been a warning since 1.36.0.
  • Fixed Self not having the correctly inferred type. This incorrectly led to some instances being accepted, and now correctly emits a hard error.

Update to version 1.42.0:

• Language

  • You can now use the slice pattern syntax with subslices.
  • You can now use #[repr(transparent)] on univariant enums. Meaning that you can create an enum that has the exact…

This update for rust, rust-cbindgen fixes the following issues:

rust was updated for use by Firefox 76ESR.

• Fixed miscompilations with rustc 1.43 that lead to LTO failures (bsc#1173202)

Update to version 1.43.1

• Updated openssl-src to 1.1.1g for CVE-2020-1967.
• Fixed the stabilization of AVX-512 features.
• Fixed cargo package --list not working with unpublished dependencies.

Update to version 1.43.0

• Language:

• Fixed using binary operations with &{number} (e.g. &1.0) not having the type inferred correctly.
• Attributes such as #[cfg()] can now be used on if expressions.
• Syntax only changes:
  • Allow type Foo: Ord syntactically.
  • Fuse associated and extern items up to defaultness.
  • Syntactically allow self in all fn contexts.
  • Merge fn syntax + cleanup item parsing.
  • item macro fragments can be interpolated into traits, impls, and extern blocks. For example, you may now write:

    macro_rules! mac_trait {
      ($i:item) => {
          trait T { $i }
      }
    }
    mac_trait! {
        fn foo() {}
    }
    

  • These are still rejected semantically, so you will likely receive an error but these changes can be seen and parsed by macros and conditional compilation.

• Compiler

• You can now pass multiple lint flags to rustc to override the previous flags.

  For example; rustc -D unused -A unused-variables denies everything in the unused lint group except unused-variables which is explicitly allowed. However, passing rustc -A unused-variables -D unused denies everything in the unused lint group including unused-variables since the allow flag is specified before the deny flag (and therefore overridden).

• rustc will now prefer your system MinGW libraries over its bundled libraries if they are available on windows-gnu.

• rustc now buffers errors/warnings printed in JSON.

Libraries:

• Arc<[T; N]>, Box<[T; N]>, and Rc<[T; N]>, now implement TryFrom<Arc<[T]>>,TryFrom<Box<[T]>>, and TryFrom<Rc<[T]>> respectively. Note These conversions are only available when N is 0..=32.
• You can now use associated constants on floats and integers directly, rather than having to import the module. e.g. You can now write u32::MAX or f32::NAN with no imports.
• u8::is_ascii is now const.
• String now implements AsMut<str>.
• Added the primitive module to std and core. This module reexports Rust's primitive types. This is mainly useful in macros where you want avoid these types being shadowed.
• Relaxed some of the trait bounds on HashMap and HashSet.
• string::FromUtf8Error now implements Clone + Eq.

• Stabilized APIs

• Once::is_completed
• f32::LOG10_2
• f32::LOG2_10
• f64::LOG10_2
• f64::LOG2_10
• iter::once_with

• Cargo

  • You can now set config [profile]s in your .cargo/config, or through your environment.
  • Cargo will now set CARGO_BIN_EXE_<name> pointing to a binary's executable path when running integration tests or benchmarks. <name> is the name of your binary as-is e.g. If you wanted the executable path for a binary named my-programyou would use env!('CARGO_BIN_EXE_my-program').

• Misc

  • Certain checks in the const_err lint were deemed unrelated to const evaluation, and have been moved to the unconditional_panic and arithmetic_overflow lints.

• Compatibility Notes

  • Having trailing syntax in the assert! macro is now a hard error. This has been a warning since 1.36.0.
  • Fixed Self not having the correctly inferred type. This incorrectly led to some instances being accepted, and now correctly emits a hard error.

Update to version 1.42.0:

• Language

  • You can now use the slice pattern syntax with subslices.
  • You can now use #[repr(transparent)] on univariant enums. Meaning that you can create an enum that has the exact…

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-1.54.0-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo1.53-1.53.0-2.5 package on the GA media of openSUSE Tumbleweed.

This update for openssl-1_1 fixes the following issues:

• CVE-2020-1967: Fixed a denial of service via NULL pointer dereference in SSL_check_chain (bsc#1169407).

This update for rust, rust-cbindgen fixes the following issues:

rust was updated for use by Firefox 76ESR.

• Fixed miscompilations with rustc 1.43 that lead to LTO failures (bsc#1173202)

Update to version 1.43.1

• Updated openssl-src to 1.1.1g for CVE-2020-1967.
• Fixed the stabilization of AVX-512 features.
• Fixed cargo package --list not working with unpublished dependencies.

Update to version 1.43.0

• Language:

• Fixed using binary operations with &{number} (e.g. &1.0) not having the type inferred correctly.
• Attributes such as #[cfg()] can now be used on if expressions.
• Syntax only changes:
  • Allow type Foo: Ord syntactically.
  • Fuse associated and extern items up to defaultness.
  • Syntactically allow self in all fn contexts.
  • Merge fn syntax + cleanup item parsing.
  • item macro fragments can be interpolated into traits, impls, and extern blocks. For example, you may now write:

    macro_rules! mac_trait {
      ($i:item) => {
          trait T { $i }
      }
    }
    mac_trait! {
        fn foo() {}
    }
    

  • These are still rejected semantically, so you will likely receive an error but these changes can be seen and parsed by macros and conditional compilation.

• Compiler

• You can now pass multiple lint flags to rustc to override the previous flags.

  For example; rustc -D unused -A unused-variables denies everything in the unused lint group except unused-variables which is explicitly allowed. However, passing rustc -A unused-variables -D unused denies everything in the unused lint group including unused-variables since the allow flag is specified before the deny flag (and therefore overridden).

• rustc will now prefer your system MinGW libraries over its bundled libraries if they are available on windows-gnu.

• rustc now buffers errors/warnings printed in JSON.

Libraries:

• Arc<[T; N]>, Box<[T; N]>, and Rc<[T; N]>, now implement TryFrom<Arc<[T]>>,TryFrom<Box<[T]>>, and TryFrom<Rc<[T]>> respectively. Note These conversions are only available when N is 0..=32.
• You can now use associated constants on floats and integers directly, rather than having to import the module. e.g. You can now write u32::MAX or f32::NAN with no imports.
• u8::is_ascii is now const.
• String now implements AsMut<str>.
• Added the primitive module to std and core. This module reexports Rust's primitive types. This is mainly useful in macros where you want avoid these types being shadowed.
• Relaxed some of the trait bounds on HashMap and HashSet.
• string::FromUtf8Error now implements Clone + Eq.

• Stabilized APIs

• Once::is_completed
• f32::LOG10_2
• f32::LOG2_10
• f64::LOG10_2
• f64::LOG2_10
• iter::once_with

• Cargo

  • You can now set config [profile]s in your .cargo/config, or through your environment.
  • Cargo will now set CARGO_BIN_EXE_<name> pointing to a binary's executable path when running integration tests or benchmarks. <name> is the name of your binary as-is e.g. If you wanted the executable path for a binary named my-programyou would use env!('CARGO_BIN_EXE_my-program').

• Misc

  • Certain checks in the const_err lint were deemed unrelated to const evaluation, and have been moved to the unconditional_panic and arithmetic_overflow lints.

• Compatibility Notes

  • Having trailing syntax in the assert! macro is now a hard error. This has been a warning since 1.36.0.
  • Fixed Self not having the correctly inferred type. This incorrectly led to some instances being accepted, and now correctly emits a hard error.

Update to version 1.42.0:

• Language

  • You can now use the slice pattern syntax with subslices.
  • You can now use #[repr(transparent)] on univariant enums. Meaning that you can create an enum that has the exact…