Linux · Security advisory · August 31, 2023
ELSA-2023-12768: Security update for 4 packages
ELSA-2023-12768, released August 31, 2023, fixes 5 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.7536
99th percentile
Priority of the 5 CVEs
Patch now 0
Urgent 0
High 1
Routine 4
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| openssl | ol 9 | 2:3.0.7-16.0.1.ksplice1.el9_2 |
| openssl-devel | ol 9 | 2:3.0.7-16.0.1.ksplice1.el9_2 |
| openssl-libs | ol 9 | 2:3.0.7-16.0.1.ksplice1.el9_2 |
| openssl-perl | ol 9 | 2:3.0.7-16.0.1.ksplice1.el9_2 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2023-0464 | libssl3t64: A security vulnerability has been identified in all supported versionsof OpenSSL related to the verification of X.509... | 7.5 | 0.0399 | None reported | |
| Routine | CVE-2023-2650 | libssl3t64: Issue summary: Processing some specially crafted ASN.1 object identifiersordata containing them may be very slow.Impa... | 6.5 | 0.7536 | None reported | |
| Routine | CVE-2023-0465 | libssl3t64: Applications that use a non-default option when verifying certificates maybevulnerable to an attack from a malicious... | 5.3 | 0.0177 | None reported | |
| Routine | CVE-2023-0466 | libssl3t64: The function X509_VERIFY_PARAM_add0_policy() is documented toimplicitly enable the certificate policy check when doin... | 5.3 | 0.0177 | None reported | |
| Routine | CVE-2023-1255 | libssl3t64: Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARMplatform contains a bug that could cause it... | 5.9 | 0.0095 | None reported |
Showing 1 to 5 of 5
1