File _patchinfo of Package patchinfo.8422

<patchinfo incident="8422">
  <issue id="1106197" tracker="bnc">[FIPS][Build 0365] openQA test fails in openssl_pubkey_rsa and generating RSA private key fail</issue>
  <issue tracker="bnc" id="1104789">VUL-1: openssl,openssl1,openssl-1_1,openssl-1_0_2: side channel attack in exponentation "'One and Done" attack</issue>
  <issue tracker="bnc" id="1097158">VUL-0: CVE-2018-0732: openssl1,openssl,compat-openssl098: Reject excessively large primes in DH key generation.</issue>
  <issue tracker="bnc" id="1089039">VUL-1: CVE-2018-0737: openssl side channel attacks against RSA keygeneration</issue>
  <issue tracker="bnc" id="1101470">OpenSSL 1.0 command line interface cannot be installed without removing essential packages</issue>
  <issue tracker="cve" id="2018-0732"/>
  <issue tracker="cve" id="2018-0737"/>
  <category>security</category>
  <rating>moderate</rating>
  <packager>vitezslav_cizek</packager>
  <description>This update for openssl-1_0_0 to 1.0.2p fixes the following issues:

These security issues were fixed:

- Prevent One&amp;Done side-channel attack on RSA that allowed physically near
  attackers to use EM emanations to recover information (bsc#1104789)
- CVE-2018-0737: The RSA Key generation algorithm has been shown to be
  vulnerable to a cache timing side channel attack. An attacker with sufficient
  access to mount cache timing attacks during the RSA key generation process
  could have recovered the private key (bsc#1089039)
- CVE-2018-0732: During key agreement in a TLS handshake using a DH(E) based
  ciphersuite a malicious server could have sent a very large prime value to the
  client. This caused the client to spend an unreasonably long period of time
  generating a key for this prime resulting in a hang until the client has
  finished. This could be exploited in a Denial Of Service attack (bsc#1097158)
- Make problematic ECDSA sign addition length-invariant
- Add blinding to ECDSA and DSA signatures to protect against side channel attacks

This non-security issue was fixed:

- Add openssl(cli) Provide so the packages that require the openssl
  binary can require this instead of the new openssl meta package
  (bsc#1101470)
</description>
  <summary>Security update for openssl-1_0_0</summary>
</patchinfo>