Bug 13309 - openssl new security issue CVE-2014-0198
: openssl new security issue CVE-2014-0198
Status: RESOLVED FIXED
Product: Mageia
Classification: Unclassified
Component: Security
: 4
: i586 Linux
: Normal Severity: normal
: ---
Assigned To: QA Team
: Sec team
: http://lwn.net/Vulnerabilities/597337/
: MGA3TOO has_procedure advisory mga3-3...
: validated_update
:
:
  Show dependency treegraph
 
Reported: 2014-05-02 21:38 CEST by David Walser
Modified: 2014-05-05 18:51 CEST (History)
2 users (show)

See Also:
Source RPM: openssl-1.0.1e-8.4.mga4.src.rpm
CVE:


Attachments

Description David Walser 2014-05-02 21:38:07 CEST
A CVE has been issued for a potential DoS issue in openssl today (May 2):
http://openwall.com/lists/oss-security/2014/05/02/6

Patched packages uploaded for Mageia 3, Mageia 4, and Cauldron.

Advisory:
========================

Updated openssl packages fix security vulnerability:

A null pointer dereference bug in OpenSSL 1.0.1g and earlier in
so_ssl3_write() could possibly allow an attacker to cause generate an SSL
alert which would cause OpenSSL to crash, resulting in a denial of service
(CVE-2014-0198).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0198
http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/005_openssl.patch.sig
http://openwall.com/lists/oss-security/2014/05/02/6
========================

Updated packages in core/updates_testing:
========================
openssl-1.0.1e-1.8.mga3
libopenssl-engines1.0.0-1.0.1e-1.8.mga3
libopenssl1.0.0-1.0.1e-1.8.mga3
libopenssl-devel-1.0.1e-1.8.mga3
libopenssl-static-devel-1.0.1e-1.8.mga3
openssl-1.0.1e-8.5.mga4
libopenssl-engines1.0.0-1.0.1e-8.5.mga4
libopenssl1.0.0-1.0.1e-8.5.mga4
libopenssl-devel-1.0.1e-8.5.mga4
libopenssl-static-devel-1.0.1e-8.5.mga4

from SRPMS:
openssl-1.0.1e-1.8.mga3.src.rpm
openssl-1.0.1e-8.5.mga4.src.rpm

Reproducible: 

Steps to Reproduce:
Comment 1 David Walser 2014-05-02 21:38:51 CEST
Testing procedure:
https://wiki.mageia.org/en/QA_procedure:Openssl
Comment 2 claire robinson 2014-05-03 14:55:43 CEST
Testing complete mga3 32 & 64 and mga4 32 & 64

Validating. Advisory uploaded.

Could sysadmin please push to 3 & 4 updates

Thanks
Comment 3 Thomas Backlund 2014-05-03 18:39:04 CEST
Update pushed:
http://advisories.mageia.org/MGASA-2014-0204.html

Note You need to log in before you can comment on or make changes to this bug.