[El-errata] New openssl updates available via Ksplice (ELSA-2022-6224)

[Errata Announcements for Oracle Linux]

Synopsis: ELSA-2022-6224 can now be patched using Ksplice
CVEs: CVE-2022-1292 CVE-2022-1343 CVE-2022-1473 CVE-2022-2068 CVE-2022-2097

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2022-6224.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OL 9 install these updates.

You can install these updates by running:

# ksplice -y user upgrade

32-bit applications should be restarted after upgrading the on-disk
openssl RPMs and statically linked applications using
openssl should be rebuilt to include these fixes.

Ksplice user-space patching requires installation of Ksplice-aware
packages and the system must be rebooted after the first installation of
these packages.  Refer to the installation instructions for the Enhanced
Ksplice Client in the Ksplice User's Guide for more details.  Systems
may be prepared for Ksplice patching by installing the Ksplice aware
packages in advance, prior to installing the enhanced Ksplice client.

DESCRIPTION

* Note: Oracle has determined that CVE-2022-2097 is not applicable.

OpenSSL is not affected by CVE-2022-2097 since the code under
consideration is not compiled.


* Note: Oracle will not provide a zero-downtime update for CVE-2022-1292 or CVE-2022-2068.

The c_rehash script affected by this CVE is not a utility that requires
live patching.  It should be straightforward to replace vulnerable
scripts with patched versions without any downtime.  However, use of the
c_rehash script is considered obsolete, and should be replaced by the
OpenSSL rehash command line tool, which is not affected by this
vulnerability.


* CVE-2022-1343: Flaw when handling revoked x.509 certificate.

Improper error handling when processing a revoked x.509 certificate
could lead OpenSSL to report the certificate as valid or unknown when in
a non-default configuration.


* CVE-2022-1473: Memory leak in lhash when flushing table.

Clearing an lhash table fails to correctly clear fields re-used by the
next table initialization, resulting in memory leaks when re-using hash
functions. On very long-lived processes, this might culminate in a
denial-of-service.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.