Red Hat Product Errata RHSA-2024:9333 - Security Advisory
Issued:
2024-11-12
Updated:
2024-11-12

RHSA-2024:9333 - Security Advisory

Synopsis

Low: openssl and openssl-fips-provider security update

Type/Severity

Security Advisory: Low

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for openssl and openssl-fips-provider is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.

Security Fix(es):

  • openssl: Unbounded memory growth with session handling in TLSv1.3 (CVE-2024-2511)
  • openssl: Excessive time spent checking DSA keys and parameters (CVE-2024-4603)
  • openssl: Use After Free with SSL_free_buffers (CVE-2024-4741)
  • openssl: SSL_select_next_proto buffer overread (CVE-2024-5535)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2274020 - CVE-2024-2511 openssl: Unbounded memory growth with session handling in TLSv1.3
  • BZ - 2281029 - CVE-2024-4603 openssl: Excessive time spent checking DSA keys and parameters
  • BZ - 2283757 - CVE-2024-4741 openssl: Use After Free with SSL_free_buffers
  • BZ - 2294581 - CVE-2024-5535 openssl: SSL_select_next_proto buffer overread
  • RHEL-26271 - Rebasing OpenSSL to 3.2.x
  • RHEL-32123 - Debug sources for OpenSSL FIPS provider
  • RHEL-38514 - Fix Minerva for OpenSSL
  • RHEL-40723 - [NetApp RHEL 9.5 Bug]: NVMe/TCP TLS connection fails due to handshake failure
  • RHEL-58662 - fips-provider after rename fails to obsolete old versions

Red Hat Enterprise Linux for x86_64 9

SRPM
openssl-3.2.2-6.el9_5.src.rpm SHA-256: b58aa63f681560c0c4716ef22de299dcfd3219fd4de4b9f0d363648c59b92f37
openssl-fips-provider-3.0.7-6.el9_5.src.rpm SHA-256: 4c7cd5a5b7095fcaa5850322ef1f1a7f42e69eacb0386d32fd6ced3dd7a9e7f5
x86_64
openssl-3.2.2-6.el9_5.x86_64.rpm SHA-256: adea7d3b99a23d01925632de46597f90b9934f7f92b40c28f34ff5c501c6d8a6
openssl-debuginfo-3.2.2-6.el9_5.i686.rpm SHA-256: d086911a5320f2e2bde076833ab9a3f75456b0dc35e96b76c29d45ced5c443a2
openssl-debuginfo-3.2.2-6.el9_5.i686.rpm SHA-256: d086911a5320f2e2bde076833ab9a3f75456b0dc35e96b76c29d45ced5c443a2
openssl-debuginfo-3.2.2-6.el9_5.x86_64.rpm SHA-256: e38a7ae258fe8f783ff58d04413fb80593c965285ae2260918740050f687dd93
openssl-debuginfo-3.2.2-6.el9_5.x86_64.rpm SHA-256: e38a7ae258fe8f783ff58d04413fb80593c965285ae2260918740050f687dd93
openssl-debugsource-3.2.2-6.el9_5.i686.rpm SHA-256: bd7d3ac493e4b183c75fe608936c72efb0236f22a8ed6bb71655a5ead255313e
openssl-debugsource-3.2.2-6.el9_5.i686.rpm SHA-256: bd7d3ac493e4b183c75fe608936c72efb0236f22a8ed6bb71655a5ead255313e
openssl-debugsource-3.2.2-6.el9_5.x86_64.rpm SHA-256: 35911c25567e567e13b8924b2c07bc703a165edff27ad1662e559663afa7ecd0
openssl-debugsource-3.2.2-6.el9_5.x86_64.rpm SHA-256: 35911c25567e567e13b8924b2c07bc703a165edff27ad1662e559663afa7ecd0
openssl-devel-3.2.2-6.el9_5.i686.rpm SHA-256: 7807b925ea8062b2cf77c89b5621baea3f33f32b42e9a05fe74a853b53832b2d
openssl-devel-3.2.2-6.el9_5.x86_64.rpm SHA-256: ec2c04ad3402fc236767674ea0591cbd2cc0dd5c780aa35ac03961002a703cde
openssl-fips-provider-3.0.7-6.el9_5.i686.rpm SHA-256: fecb5b85cf490f35464f1bcf53dc8a2adbd9df59b4c2c1e1c6edecbed527fc36
openssl-fips-provider-3.0.7-6.el9_5.x86_64.rpm SHA-256: bd9266695b8238ed6fe436ae5f613cee2e5e1ee5d612ab495f1da2f21f2830aa
openssl-fips-provider-so-3.0.7-6.el9_5.x86_64.rpm SHA-256: 451372cea98f4993b2a4a2ed5876f1a661450e7487f73f945bbaf34789931437
openssl-fips-provider-so-debuginfo-3.0.7-6.el9_5.i686.rpm SHA-256: b3bc697375a24061d56a65a3955900c3c1885438c3c67be99f5f0abc4924edd7
openssl-fips-provider-so-debuginfo-3.0.7-6.el9_5.x86_64.rpm SHA-256: 0a02c31ed5a4dd2072c7fbc0becd7565ebf26aff41f0746670ead817adbb0786
openssl-fips-provider-so-debugsource-3.0.7-6.el9_5.i686.rpm SHA-256: 50c0b5f8fc87bc871ce34b48c9ea3c685bde1d6d2e980ca2c080688deebbc583
openssl-fips-provider-so-debugsource-3.0.7-6.el9_5.x86_64.rpm SHA-256: e619365eed1c2b7bccb5c74110fb7c9f196d25c5d87fe4872646b898018b2651
openssl-libs-3.2.2-6.el9_5.i686.rpm SHA-256: 0ccbe9cc40e5f9a50c03d9f326fd642ed9ff30bff0aa80c580a857bbda4ebc40
openssl-libs-3.2.2-6.el9_5.x86_64.rpm SHA-256: 1b89400a1af77fef43980b95933ddccd6ee23834a95a9869ca9113fee20cdbc0
openssl-libs-debuginfo-3.2.2-6.el9_5.i686.rpm SHA-256: 026f830854cef6e69684f098bb7527fb441f2f9fd56c1435f5a9d2494947cbca
openssl-libs-debuginfo-3.2.2-6.el9_5.i686.rpm SHA-256: 026f830854cef6e69684f098bb7527fb441f2f9fd56c1435f5a9d2494947cbca
openssl-libs-debuginfo-3.2.2-6.el9_5.x86_64.rpm SHA-256: e5b97667f1f68ff50c75c566920705e17e5dd1de156b3e43538d759586d47ce2
openssl-libs-debuginfo-3.2.2-6.el9_5.x86_64.rpm SHA-256: e5b97667f1f68ff50c75c566920705e17e5dd1de156b3e43538d759586d47ce2
openssl-perl-3.2.2-6.el9_5.x86_64.rpm SHA-256: a9e11077eab8de3fd06348a7ec24f792f2ba7a4c59d4d3238a5d68e70e133fb9

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
openssl-3.2.2-6.el9_5.src.rpm SHA-256: b58aa63f681560c0c4716ef22de299dcfd3219fd4de4b9f0d363648c59b92f37
openssl-fips-provider-3.0.7-6.el9_5.src.rpm SHA-256: 4c7cd5a5b7095fcaa5850322ef1f1a7f42e69eacb0386d32fd6ced3dd7a9e7f5
s390x
openssl-3.2.2-6.el9_5.s390x.rpm SHA-256: 2beedaddbb49df52f48b181aa1515c59e600799f8784a691b098c43d77853376
openssl-debuginfo-3.2.2-6.el9_5.s390x.rpm SHA-256: 095ce30db89f9b8611215e0b848f539a9859196368c6fe3a66780a7aac6125f2
openssl-debuginfo-3.2.2-6.el9_5.s390x.rpm SHA-256: 095ce30db89f9b8611215e0b848f539a9859196368c6fe3a66780a7aac6125f2
openssl-debugsource-3.2.2-6.el9_5.s390x.rpm SHA-256: d66a6bc11e25e25f2cb9758c35982cf315b7bdab3d05cf11a1a0bf532da8cdb7
openssl-debugsource-3.2.2-6.el9_5.s390x.rpm SHA-256: d66a6bc11e25e25f2cb9758c35982cf315b7bdab3d05cf11a1a0bf532da8cdb7
openssl-devel-3.2.2-6.el9_5.s390x.rpm SHA-256: 8b0dd90419d2e6c593a5f62b0cea65da808dc857b2ba99b32111080cd275d0c4
openssl-fips-provider-3.0.7-6.el9_5.s390x.rpm SHA-256: 096b14db9e35af57355ac0d6f7637112f7d4691fede82b829e5e70c9010c65d7
openssl-fips-provider-so-3.0.7-6.el9_5.s390x.rpm SHA-256: 8fd9b27724feb805908e3f43bd7c50373e09c07bdd0c0d747ed1ca580fa64114
openssl-fips-provider-so-debuginfo-3.0.7-6.el9_5.s390x.rpm SHA-256: 9e98a0d5ca3d86d70cc7ca94b1e73b67603bd545b83762ff5f6b3c8deaa09c1a
openssl-fips-provider-so-debugsource-3.0.7-6.el9_5.s390x.rpm SHA-256: d4d2ecfadae38d364d5049a829e3c23258780abf5ee345bd62c6666a71618b08
openssl-libs-3.2.2-6.el9_5.s390x.rpm SHA-256: 2210ce2282d1c8916acc7b129a95530b190e567ab1579362214e31f57628179f
openssl-libs-debuginfo-3.2.2-6.el9_5.s390x.rpm SHA-256: 18f47a752fa70b2970f95d6692842004414241ca11bd71f0905bbf3ba30b8898
openssl-libs-debuginfo-3.2.2-6.el9_5.s390x.rpm SHA-256: 18f47a752fa70b2970f95d6692842004414241ca11bd71f0905bbf3ba30b8898
openssl-perl-3.2.2-6.el9_5.s390x.rpm SHA-256: 39d2ebf32cca04413bb88b6feb3aabf4d2966f257b53c9a0d33d4435c6331f12

Red Hat Enterprise Linux for Power, little endian 9

SRPM
openssl-3.2.2-6.el9_5.src.rpm SHA-256: b58aa63f681560c0c4716ef22de299dcfd3219fd4de4b9f0d363648c59b92f37
openssl-fips-provider-3.0.7-6.el9_5.src.rpm SHA-256: 4c7cd5a5b7095fcaa5850322ef1f1a7f42e69eacb0386d32fd6ced3dd7a9e7f5
ppc64le
openssl-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 4f89f5cf48a836392a03f8e037cdcb55b2d2b4ab05b8bba821a11cbc3e9a355d
openssl-debuginfo-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 4dc01ad6521a726b2741a88464d498663cc224bd6c2896c65387c2e787db81ab
openssl-debuginfo-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 4dc01ad6521a726b2741a88464d498663cc224bd6c2896c65387c2e787db81ab
openssl-debugsource-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 90d0f3516e291cdd1b5008db26d20209a0104a9916598ebbe00af4f3b33b1db8
openssl-debugsource-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 90d0f3516e291cdd1b5008db26d20209a0104a9916598ebbe00af4f3b33b1db8
openssl-devel-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 5c444fbe89e14c14d0c3d41cad70706e4c6ae546c0b2a241699ce51d00bc823c
openssl-fips-provider-3.0.7-6.el9_5.ppc64le.rpm SHA-256: b73a8baa5f9ad63a9e5afa6c5b3d21c2a9c5d783f129350abb2b234bcf24f17d
openssl-fips-provider-so-3.0.7-6.el9_5.ppc64le.rpm SHA-256: 1b4d38df810d7d307ddd529b423edd806fb3832c6a547a065cbf6a9d92987d26
openssl-fips-provider-so-debuginfo-3.0.7-6.el9_5.ppc64le.rpm SHA-256: 291673c16adc1e5f6a6da8eb6b299ecf6b20f047353acb4fc959640f438f4d76
openssl-fips-provider-so-debugsource-3.0.7-6.el9_5.ppc64le.rpm SHA-256: 23e4357186d419bd3ea4a61c3e644db8ccbe38faf18f4cf1c28f039a86328626
openssl-libs-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 1922fdb13079afcec6d45daab50e5f0a002ca1ba9b36868b816799ac06a1e6ee
openssl-libs-debuginfo-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 7177484cff86661e90d36a141cbd206e96ab6e2e34b90d4a6487e1ebc13c8cc6
openssl-libs-debuginfo-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 7177484cff86661e90d36a141cbd206e96ab6e2e34b90d4a6487e1ebc13c8cc6
openssl-perl-3.2.2-6.el9_5.ppc64le.rpm SHA-256: 9a09ddff1b7a4bcb4c5a67937a62b325fb2bf4c64864bd7a0ce63641a347f0c9

Red Hat Enterprise Linux for ARM 64 9

SRPM
openssl-3.2.2-6.el9_5.src.rpm SHA-256: b58aa63f681560c0c4716ef22de299dcfd3219fd4de4b9f0d363648c59b92f37
openssl-fips-provider-3.0.7-6.el9_5.src.rpm SHA-256: 4c7cd5a5b7095fcaa5850322ef1f1a7f42e69eacb0386d32fd6ced3dd7a9e7f5
aarch64
openssl-3.2.2-6.el9_5.aarch64.rpm SHA-256: c49a72d3ec0bf190d120d64ff9561dd6aa9a7928f0ffcd726daa626974e69902
openssl-debuginfo-3.2.2-6.el9_5.aarch64.rpm SHA-256: 3b4b999407b22a8f29c8b53ac14b74063b4e58e8b0669f0eae22223c0ab1bc94
openssl-debuginfo-3.2.2-6.el9_5.aarch64.rpm SHA-256: 3b4b999407b22a8f29c8b53ac14b74063b4e58e8b0669f0eae22223c0ab1bc94
openssl-debugsource-3.2.2-6.el9_5.aarch64.rpm SHA-256: 0b6803152b9049c199cd63b895148f8a8a8226ddaea38e6f2f3c74b0b48e86d2
openssl-debugsource-3.2.2-6.el9_5.aarch64.rpm SHA-256: 0b6803152b9049c199cd63b895148f8a8a8226ddaea38e6f2f3c74b0b48e86d2
openssl-devel-3.2.2-6.el9_5.aarch64.rpm SHA-256: 178e3b3d7afe60bc2a364eddc3e29429592040967a2ed00b66a48adb3e69036c
openssl-fips-provider-3.0.7-6.el9_5.aarch64.rpm SHA-256: 33ad14837e13796c95c8dfc02afec41a10e2d5dc42a07599c6c403025383303a
openssl-fips-provider-so-3.0.7-6.el9_5.aarch64.rpm SHA-256: 20728673b4e8c438d90a8d10ac40c0ecfe9df109b17e1ed4ece30dcbcd80ea84
openssl-fips-provider-so-debuginfo-3.0.7-6.el9_5.aarch64.rpm SHA-256: 6374048e185dc61052e70d23c97162623456b24ada9486ac31407a087cc47a30
openssl-fips-provider-so-debugsource-3.0.7-6.el9_5.aarch64.rpm SHA-256: d97e459fbb071736b279db85908b6bbe1fe7f528d3d15d67b65af293236c86f5
openssl-libs-3.2.2-6.el9_5.aarch64.rpm SHA-256: b3da72c1e526d841742fe61dec94ba6f58bf3b10de4ff508f297bfffe397348d
openssl-libs-debuginfo-3.2.2-6.el9_5.aarch64.rpm SHA-256: 19a045fe0c15431f9eae4cd60338174bc34f3c0d2856f092996b69ba514821ef
openssl-libs-debuginfo-3.2.2-6.el9_5.aarch64.rpm SHA-256: 19a045fe0c15431f9eae4cd60338174bc34f3c0d2856f092996b69ba514821ef
openssl-perl-3.2.2-6.el9_5.aarch64.rpm SHA-256: a2fd23223c0f8e4235326b3c6f403325da7f58abe99682fce63eb9cf92a86a0c

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.