stable

openssl-3.0.5-3.fc37

FEDORA-2022-0f1d2e0537 created by dbelyavs 2 years ago for Fedora 37

Security fix for CVE-2022-3602 and CVE-2022-3786

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2022-0f1d2e0537

This update has been submitted for testing by dbelyavs.

2 years ago

This update's test gating status has been changed to 'waiting'.

2 years ago
User Icon bittin provided feedback 2 years ago
karma
BZ#2137723 CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
BZ#2139149 [Major Incident] CVE-2022-3602 openssl: X.509 Email Address Buffer Overflow [fedora-all]
User Icon mikelo2 provided feedback 2 years ago
karma
karma
User Icon copperi provided feedback 2 years ago
karma
User Icon pbrobinson commented & provided feedback 2 years ago
karma

Tested on x86_64 and aarch64 across a number of services that use openssl inc openssh, postfix, dovecot, httpd using TLS1.2 and 1.3 and a number of client apps

BZ#2137723 CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
BZ#2139149 [Major Incident] CVE-2022-3602 openssl: X.509 Email Address Buffer Overflow [fedora-all]
User Icon imsedgar commented & provided feedback 2 years ago

If the build fixes CVE-2022-3786, then BZ#2139151 and BZ#2139104 should also be linked to this update?

User Icon robatino commented & provided feedback 2 years ago

As soon as the test gating status changes to "passed", another +1 (even from someone who already gave +1) will be necessary to get it submitted for stable.

adamwill edited this update.

2 years ago
User Icon py0xc3 commented & provided feedback 2 years ago
karma

Works fine within F37 x86_64 KVM VM. CVEs not verified/checked.

This update's test gating status has been changed to 'failed'.

2 years ago
karma
User Icon copperi provided feedback 2 years ago
karma
User Icon grahamwhiteuk commented & provided feedback 2 years ago
karma

LGTM

User Icon nb provided feedback 2 years ago
karma
BZ#2137661 upcoming critical openssl vulnerability
BZ#2137723 CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
BZ#2139149 [Major Incident] CVE-2022-3602 openssl: X.509 Email Address Buffer Overflow [fedora-all]

This update's test gating status has been changed to 'passed'.

2 years ago

This update has been submitted for stable by adamwill.

2 years ago

This update has been pushed to stable.

2 years ago
User Icon augenauf commented & provided feedback 2 years ago

Hi @nb

how did you test for the CVEs? Thank you.


Please login to add feedback.

Metadata
Type
security
Severity
high
Karma
9
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-3
Stable by Karma
3
Stable by Time
14 days
Dates
submitted
2 years ago
in stable
2 years ago
modified
2 years ago
BZ#2137661 upcoming critical openssl vulnerability
0
1
BZ#2137723 CVE-2022-3602 OpenSSL: X.509 Email Address Buffer Overflow
0
3
BZ#2139149 [Major Incident] CVE-2022-3602 openssl: X.509 Email Address Buffer Overflow [fedora-all]
0
3

Automated Test Results