Bug 24888 - openssl new security issues CVE-2019-154[37] and CVE-2019-1563
Summary: openssl new security issues CVE-2019-154[37] and CVE-2019-1563
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 7
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2019-05-31 20:31 CEST by David Walser
Modified: 2019-12-24 00:16 CET (History)
7 users (show)

See Also:
Source RPM: openssl-1.1.0j-1.mga7.src.rpm, compat-openssl10-1.0.2r-1.mga7.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2019-05-31 20:31:34 CEST
Upstream has issued an advisory on March 6:
https://www.openssl.org/news/secadv/20190306.txt

The issue was fixed in OpenSSL 1.0.2s and OpenSSL 1.1.0k on May 28.

This sounds like a very minor issue, so we could probably wait for the next OpenSSL update(s) to fix it.

Mageia 6 and Mageia 7 are also affected.
David Walser 2019-05-31 20:32:24 CEST

Whiteboard: (none) => MGA7TOO, MGA6TOO
Source RPM: openssl, compat-openssl10 => openssl-1.1.0j-1.mga7.src.rpm, compat-openssl10-1.0.2r-1.mga7.src.rpm

Comment 1 Marja Van Waes 2019-05-31 20:52:34 CEST
Assigning to the base system maintainers, because: 

[marja@cldrn64 ~]$ urpmq --requires-recursive basesystem-minimal | grep ssl
lib64openssl1.1
[marja@cldrn64 ~]$

CC'ing two submitters.

Assignee: bugsquad => basesystem
CC: (none) => geiger.david68210, marja11, nicolas.salguero

Comment 2 David Walser 2019-08-11 23:34:50 CEST
Debian has issued an advisory for this on July 1:
https://www.debian.org/security/2019/dsa-4475
Comment 3 David Walser 2019-10-31 04:31:10 CET
Upstream has issued an advisory on September 10:
https://www.openssl.org/news/secadv/20190910.txt

Debian has issued an advisory for this on October 1:
https://www.debian.org/security/2019/dsa-4540

Summary: openssl new security issue CVE-2019-1543 => openssl new security issues CVE-2019-154[37] and CVE-2019-1563

Comment 4 David Walser 2019-10-31 04:33:44 CET
The new issues are fixed in 1.0.2t and 1.1.0l.
Comment 5 Nicolas Salguero 2019-11-26 15:22:02 CET
Suggested advisory:
========================

The updated packages fix security vulnerabilities:

ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length and front pads the nonce with 0 bytes if it is less than 12 bytes. However it also incorrectly allows a nonce to be set of up to 16 bytes. In this case only the last 12 bytes are significant and any additional leading bytes are ignored. It is a requirement of using this cipher that nonce values are unique. Messages encrypted using a reused nonce value are susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce. Additionally the ignored bytes in a long nonce are not covered by the integrity guarantee of this cipher. Any application that relies on the integrity of these ignored leading bytes of a long nonce may be further affected. Any OpenSSL internal use of this cipher, including in SSL/TLS, is safe because no such use sets such a long nonce value. However user applications that use this cipher directly and set a non-default nonce length to be longer than 12 bytes may be vulnerable. (CVE-2019-1543)

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. (CVE-2019-1547)

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted with the public RSA key, using a Bleichenbacher padding oracle attack. Applications are not affected if they use a certificate together with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions to select the correct recipient info to decrypt. (CVE-2019-1563)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1543
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1547
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563
https://www.openssl.org/news/secadv/20190306.txt
https://www.debian.org/security/2019/dsa-4475
https://www.openssl.org/news/secadv/20190910.txt
https://www.debian.org/security/2019/dsa-4540
========================

Updated packages in core/updates_testing:
========================
compat-openssl10-1.0.2t-1.mga7
lib(64)compat-openssl10_1.0.0-1.0.2t-1.mga7
lib(64)compat-openssl10-devel-1.0.2t-1.mga7
openssl-1.1.0l-1.mga7
lib(64)openssl1.1-1.1.0l-1.mga7
lib(64)openssl-devel-1.1.0l-1.mga7
lib(64)openssl-static-devel-1.1.0l-1.mga7
openssl-perl-1.1.0l-1.mga7

from SRPMS:
compat-openssl10-1.0.2t-1.mga7.src.rpm
openssl-1.1.0l-1.mga7.src.rpm

Whiteboard: MGA7TOO, MGA6TOO => (none)
Status: NEW => ASSIGNED
Version: Cauldron => 7

Nicolas Salguero 2019-11-26 15:22:28 CET

Assignee: basesystem => qa-bugs

Comment 6 PC LX 2019-12-01 19:45:45 CET
Installed and tested without issues.

Lots of packages on this workstation depend on openssl and after 3 days of normal usage and some applications testing, no regressions were noticed. Explicitly tested openssl's various commands (e.g. s_client, genkey, speed), no issues found.


System: Mageia 7, x86_64, Intel CPU. 


$ uname -a
Linux marte 5.3.13-desktop-2.mga7 #1 SMP Mon Nov 25 20:30:40 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
$ rpm -qa | grep openssl | sort
lib64compat-openssl10_1.0.0-1.0.2t-1.mga7
lib64openssl1.1-1.1.0l-1.mga7
libopenssl1.1-1.1.0l-1.mga7
openssl-1.1.0l-1.mga7
php-openssl-7.3.11-1.mga7

CC: (none) => mageia

PC LX 2019-12-01 19:46:10 CET

Whiteboard: (none) => MGA7-64-OK

Comment 7 Thomas Andrews 2019-12-04 01:07:09 CET
Thank you, PC LX. Validating. Advisory in Comment 5.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2019-12-06 14:00:35 CET

Keywords: (none) => advisory
CC: (none) => tmb

Comment 8 Mageia Robot 2019-12-06 15:17:07 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2019-0354.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED

Comment 9 David Walser 2019-12-24 00:16:24 CET
This update also fixed CVE-2019-1552:
https://www.openssl.org/news/secadv/20190730.txt

Note You need to log in before you can comment on or make changes to this bug.