[El-errata] New openssl updates available via Ksplice (ELSA-2018-0998)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2018-0998 can now be patched using Ksplice
CVEs: CVE-2017-3736 CVE-2017-3737 CVE-2017-3738

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2018-0998.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OL 7 install these updates.

You can install these updates by running:

# ksplice -y user upgrade

32-bit applications should be restarted after upgrading the on-disk
openssl RPMs and statically linked applications using
openssl should be rebuilt to include these fixes.

Ksplice user-space patching requires installation of Ksplice-aware
packages and the system must be rebooted after the first installation of
these packages.  Refer to the installation instructions for the Enhanced
Ksplice Client in the Ksplice User's Guide for more details.  Systems
may be prepared for Ksplice patching by installing the Ksplice aware
packages in advance, prior to installing the enhanced Ksplice client.

DESCRIPTION

* CVE-2017-3736: Private key information leak in Montgomery squaring.

A carry propagation bug in the Montgomery squaring function could allow
leaking of some private key information under specific conditions
allowing an attacker with access to a system that shared a private key
between clients and persistent DH parameters to compromise sensitive
data.


* CVE-2017-3737: Security bypass in SSL.

Incorrect error handling during SSL handshake could allow a connection
to continue without encryption allowing a malicious user spoofing a
server to leak information from connections.


* CVE-2017-3738: Private key information leak in AVX2 Montgomery multiplication.

An overflow when handling 1024-bit moduli could allow an attacker with
access to a system that shared a private key between clients to
compromise sensitive data.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.