MGASA-2019-0354 - Updated openssl packages fix security vulnerabilities

Publication date: 06 Dec 2019
URL: https://advisories.mageia.org/MGASA-2019-0354.html
Type: security
Affected Mageia releases: 7
CVE: CVE-2019-1543,
     CVE-2019-1547,
     CVE-2019-1563

The updated packages fix security vulnerabilities:

ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input
for every encryption operation. RFC 7539 specifies that the nonce value
(IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce length
and front pads the nonce with 0 bytes if it is less than 12 bytes. However
it also incorrectly allows a nonce to be set of up to 16 bytes. In this
case only the last 12 bytes are significant and any additional leading
bytes are ignored. It is a requirement of using this cipher that nonce
values are unique. Messages encrypted using a reused nonce value are
susceptible to serious confidentiality and integrity attacks. If an
application changes the default nonce length to be longer than 12 bytes
and then makes a change to the leading bytes of the nonce expecting the
new value to be a new unique nonce then such an application could
inadvertently encrypt messages with a reused nonce. Additionally the
ignored bytes in a long nonce are not covered by the integrity guarantee
of this cipher. Any application that relies on the integrity of these
ignored leading bytes of a long nonce may be further affected. Any OpenSSL
internal use of this cipher, including in SSL/TLS, is safe because no such
use sets such a long nonce value. However user applications that use this
cipher directly and set a non-default nonce length to be longer than 12
bytes may be vulnerable. (CVE-2019-1543)

Normally in OpenSSL EC groups always have a co-factor present and this is
used in side channel resistant code paths. However, in some cases, it is
possible to construct a group using explicit parameters (instead of using
a named curve). In those cases it is possible that such a group does not
have the cofactor present. This can occur even where all the parametersmatch a known named curve. If such a curve is used then OpenSSL falls back
to non-side channel resistant code paths which may result in full key
recovery during an ECDSA signature operation. In order to be vulnerable an
attacker would have to have the ability to time the creation of a large
number of signatures where explicit parameters with no co-factor present
are in use by an application using libcrypto. For the avoidance of doubt
libssl is not vulnerable because explicit parameters are never used.
(CVE-2019-1547)

In situations where an attacker receives automated notification of the
success or failure of a decryption attempt an attacker, after sending a
very large number of messages to be decrypted, can recover a CMS/PKCS7
transported encryption key or decrypt any RSA encrypted message that was
encrypted with the public RSA key, using a Bleichenbacher padding oracle
attack. Applications are not affected if they use a certificate together
with the private RSA key to the CMS_decrypt or PKCS7_decrypt functions
to select the correct recipient info to decrypt. (CVE-2019-1563)

References:
- https://bugs.mageia.org/show_bug.cgi?id=24888
- https://openssl-library.org/news/secadv/20190306.txt
- https://www.debian.org/security/2019/dsa-4475
- https://openssl-library.org/news/secadv/20190910.txt
- https://www.debian.org/security/2019/dsa-4540
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1543
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1547
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1563

SRPMS:
- 7/core/openssl-1.1.0l-1.mga7
- 7/core/compat-openssl10-1.0.2t-1.mga7