stable

openssl-3.0.5-3.fc37

FEDORA-2022-0f1d2e0537 created by dbelyavs 3 months ago for Fedora 37

Security fix for CVE-2022-3602 and CVE-2022-3786

How to install

sudo dnf upgrade --refresh --advisory=FEDORA-2022-0f1d2e0537

This update has been submitted for testing by dbelyavs.

3 months ago

This update's test gating status has been changed to 'waiting'.

3 months ago
User Icon bittin provided feedback 3 months ago
karma
BZ#2137723 CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
BZ#2139149 [Major Incident] CVE-2022-3602 openssl: X.509 Email Address Buffer Overflow [fedora-all]
User Icon mikelo2 provided feedback 3 months ago
karma
karma
User Icon copperi provided feedback 3 months ago
karma
User Icon pbrobinson commented & provided feedback 3 months ago
karma

Tested on x86_64 and aarch64 across a number of services that use openssl inc openssh, postfix, dovecot, httpd using TLS1.2 and 1.3 and a number of client apps

BZ#2137723 CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
BZ#2139149 [Major Incident] CVE-2022-3602 openssl: X.509 Email Address Buffer Overflow [fedora-all]
User Icon imsedgar commented & provided feedback 3 months ago

If the build fixes CVE-2022-3786, then BZ#2139151 and BZ#2139104 should also be linked to this update?

User Icon robatino commented & provided feedback 3 months ago

As soon as the test gating status changes to "passed", another +1 (even from someone who already gave +1) will be necessary to get it submitted for stable.

adamwill edited this update.

3 months ago
User Icon py0xc3 commented & provided feedback 3 months ago
karma

Works fine within F37 x86_64 KVM VM. CVEs not verified/checked.

This update's test gating status has been changed to 'failed'.

3 months ago
karma
User Icon copperi provided feedback 3 months ago
karma
User Icon grahamwhiteuk commented & provided feedback 3 months ago
karma

LGTM

User Icon nb provided feedback 3 months ago
karma
BZ#2137661 upcoming critical openssl vulnerability
BZ#2137723 CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
BZ#2139149 [Major Incident] CVE-2022-3602 openssl: X.509 Email Address Buffer Overflow [fedora-all]

This update's test gating status has been changed to 'passed'.

3 months ago

This update has been submitted for stable by adamwill.

3 months ago

This update has been pushed to stable.

3 months ago
User Icon augenauf commented & provided feedback 3 months ago

Hi @nb

how did you test for the CVEs? Thank you.


Please login to add feedback.

Metadata
Type
security
Severity
high
Karma
9
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-3
Stable by Karma
3
Stable by Time
14 days
Dates
submitted
3 months ago
in stable
3 months ago
modified
3 months ago
BZ#2137661 upcoming critical openssl vulnerability
0
1
BZ#2137723 CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
0
3
BZ#2139149 [Major Incident] CVE-2022-3602 openssl: X.509 Email Address Buffer Overflow [fedora-all]
0
3

Automated Test Results

passed