Bug 31308

Summary:	openssl new security issue CVE-2022-3996
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	All Packagers <pkg-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	nicolas.salguero
Version:	Cauldron
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:
Source RPM:	openssl-3.0.5-3.mga9.src.rpm	CVE:
Status comment:	Fixed upstream in 3.0.8

Description David Walser 2022-12-21 17:01:29 CET

OpenSSL has issued an advisory on December 13:
https://www.openssl.org/news/secadv/20221213.txt

The issue is fixed upstream in 3.0.8.

Comment 1 David Walser 2022-12-21 17:02:44 CET

openSUSE has issued an advisory for this on December 20:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DNJ36X7C7HDY23A7KUN4WU7VEMCY2HUV/

Status comment: (none) => Fixed upstream in 3.0.8

Comment 2 Lewis Smith 2022-12-21 20:22:10 CET

Different people commit this SRPM, so asigning the bug globally.
CC'ing NicolasS who has done several CVEs previously.

CC: (none) => nicolas.salguero
Assignee: bugsquad => pkg-bugs

Comment 3 Nicolas Salguero 2023-01-20 10:23:34 CET

Hi,

openssl-3.0.5-4.mga9 includes the patch from openSUSE.

Best regards,

Nico.

Comment 4 David Walser 2023-01-20 15:45:18 CET

Thanks.  Any chance we can get 3.0.8 to build?

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 5 Nicolas Salguero 2023-01-20 15:54:39 CET

Sadly, for the moment, version 3.0.8 is not released.