Bug 31308 - openssl new security issue CVE-2022-3996
Summary: openssl new security issue CVE-2022-3996
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: All Packagers
QA Contact: Sec team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-12-21 17:01 CET by David Walser
Modified: 2023-01-20 15:54 CET (History)
1 user (show)

See Also:
Source RPM: openssl-3.0.5-3.mga9.src.rpm
CVE:
Status comment: Fixed upstream in 3.0.8

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2022-12-21 17:01:29 CET 
OpenSSL has issued an advisory on December 13:
https://www.openssl.org/news/secadv/20221213.txt

The issue is fixed upstream in 3.0.8.
Comment 1 David Walser 2022-12-21 17:02:44 CET 
openSUSE has issued an advisory for this on December 20:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DNJ36X7C7HDY23A7KUN4WU7VEMCY2HUV/

Status comment: (none) => Fixed upstream in 3.0.8

Comment 2 Lewis Smith 2022-12-21 20:22:10 CET 
Different people commit this SRPM, so asigning the bug globally.
CC'ing NicolasS who has done several CVEs previously.

CC: (none) => nicolas.salguero
Assignee: bugsquad => pkg-bugs

Comment 3 Nicolas Salguero 2023-01-20 10:23:34 CET 
Hi,

openssl-3.0.5-4.mga9 includes the patch from openSUSE.

Best regards,

Nico.
Comment 4 David Walser 2023-01-20 15:45:18 CET 
Thanks.  Any chance we can get 3.0.8 to build?

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 5 Nicolas Salguero 2023-01-20 15:54:39 CET 
Sadly, for the moment, version 3.0.8 is not released.
Note You need to log in before you can comment on or make changes to this bug.