Linux · Security advisory · May 3, 2024

ELSA-2024-2447: Security update for 5 packages

ELSA-2024-2447, released May 3, 2024, fixes 7 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: Routine.

Routine
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0653
93rd percentile

Priority of the 7 CVEs

Patch now 0 Urgent 0 High 0 Routine 7

Fixed package versions

ProductReleaseFixed in
opensslol 91:3.0.7-27.0.3.el9
openssl-develol 91:3.0.7-27.0.3.el9
openssl-fips-providerol 90:3.0.7-2.0.1.el9
openssl-libsol 91:3.0.7-27.0.3.el9
openssl-perlol 91:3.0.7-27.0.3.el9

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Routine CVE-2023-3446 openssl: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as... 5.9 0.0653 None reported
Routine CVE-2023-5678 libssl3t64: Issue summary: Generating excessively long X9.42 DH keys or checkingexcessively long X9.42 DH keys or parameters may... 5.9 0.0446 None reported
Routine CVE-2024-0727 libssl3t64: Issue summary: Processing a maliciously formatted PKCS12 file may leadOpenSSLto crash leading to a potential Denial o... 5.5 0.0319 None reported
Routine CVE-2023-3817 openssl-devel: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as... 5.9 0.0305 None reported
Routine CVE-2023-6129 libssl3t64: Issue summary: The POLY1305 MAC (message authentication code)implementationcontains a bug that might corrupt the inte... 6.5 0.0232 None reported
Routine CVE-2023-6237 libssl3t64: Issue summary: Checking excessively long invalid RSA public keys may takea long time.Impact summary: Applications tha... 5.9 0.0230 None reported
Routine CVE-2023-2975 openssl: Issue summary: The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entrie... 5.3 0.0062 None reported
Showing 1 to 7 of 7 1