File _patchinfo of Package patchinfo.9477

<patchinfo incident="9477">
  <issue tracker="bnc" id="1110018">SLES11sp3 ltss: Customer is asking for verification of CVE-2016-8610 openssl-0.9.8j-0.106.12.1.x86_64</issue>
  <issue tracker="bnc" id="1101470">OpenSSL 1.0 command line interface cannot be installed without removing essential packages</issue>
  <issue tracker="bnc" id="1106197">[FIPS][Build 0365] openQA test fails in openssl_pubkey_rsa and generating RSA private key fail</issue>
  <issue tracker="bnc" id="1104789">VUL-1: openssl,openssl1,openssl-1_1,openssl-1_0_2: side channel attack in exponentation "'One and Done" attack</issue>
  <issue tracker="bnc" id="1113652">VUL-1: CVE-2018-0734: openssl,openssl1,openssl-1_1,openssl-1_0_0,compat-openssl098: Timing vulnerability in DSA signature generation</issue>
  <issue tracker="bnc" id="1113534">VUL-0: CVE-2018-5407: Hyperthread port content side channel aka "PortSmash"</issue>
  <issue tracker="cve" id="2016-8610"/>
  <issue tracker="cve" id="2018-0734"/>
  <issue tracker="cve" id="2018-0737"/>
  <issue tracker="cve" id="2018-5407"/>
  <category>security</category>
  <rating>moderate</rating>
  <packager>vitezslav_cizek</packager>
  <description>This update for openssl fixes the following issues:

Security issues fixed:

- CVE-2018-0734: Fixed timing vulnerability in DSA signature generation (bsc#1113652).
- CVE-2018-5407: Fixed elliptic curve scalar multiplication timing attack defenses (bsc#1113534).
- CVE-2018-0737: Corrected the current error detection of the current fix (bsc#1106197). 
- CVE-2016-8610: Adjusted current fix and add missing error string (bsc#1110018).
- Add missing timing side channel patch for DSA signature generation (bsc#1113742).
- Fixed the "One and Done" side-channel attack on RSA (bsc#1104789).

Non-security issues fixed:

- Added openssl(cli) so that the packages that required the openssl binary can require this instead of the new openssl meta package (bsc#1101470).
</description>
  <summary>Security update for openssl</summary>
</patchinfo>