File _patchinfo of Package patchinfo.35141

<patchinfo incident="35141">
  <issue tracker="bnc" id="1229465">VUL-0: EMBARGOED: CVE-2024-6119: openssl-3: possible denial of service in X.509 name checks</issue>
  <issue tracker="bnc" id="1221786">[FIPS][OpenSSL-3] Use of non-Approved Elliptic Curves</issue>
  <issue tracker="bnc" id="1220696">[FIPS][OpenSSL-3] Change CRNG buf size to align with output size of the Jitter RNG.</issue>
  <issue tracker="bnc" id="1221752">[FIPS][OpenSSL-3] Zeroisation is required</issue>
  <issue tracker="bnc" id="1221821">[FIPS][OpenSSL-3] FIPS Domain Parameters</issue>
  <issue tracker="bnc" id="1220523">[FIPS][OpenSSL-3] Entropy Source</issue>
  <issue tracker="bnc" id="1221365">[FIPS][OpenSSL-3] Service Level Indicator is needed</issue>
  <issue tracker="bnc" id="1221751">[FIPS][OpenSSL-3] The FIPS module shall provide an output possibility</issue>
  <issue tracker="bnc" id="1220690">[FIPS][OpenSSL-3] Primary DRBG for openssl needs to have prediction resistance enabled or it shall be reseeded every time before providing an output to the caller.</issue>
  <issue tracker="bnc" id="1221822">[FIPS][OpenSSL-3] NIST SP 800-56Arev3</issue>
  <issue tracker="bnc" id="1221787">[FIPS][OpenSSL-3]  Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4</issue>
  <issue tracker="bnc" id="1221827">[FIPS][OpenSSL-3] Recommendation for Password-Based Key Derivation</issue>
  <issue tracker="bnc" id="1221824">[FIPS][OpenSSL-3] NIST SP 800-56Brev2</issue>
  <issue tracker="bnc" id="1220693">[FIPS][OpenSSL-3] Add oversampling of the noise source to comply with requirements of NIST SP 800-90C.</issue>
  <issue tracker="bnc" id="1221760">[FIPS][OpenSSL-3] Selftests are required</issue>
  <issue tracker="bnc" id="1221753">[FIPS][OpenSSL-3] Error state has to be enforced</issue>
  <issue tracker="cve" id="2024-6119"/>
  <packager>abergmann</packager>
  <rating>moderate</rating>
  <category>security</category>
  <summary>Security update for openssl-3</summary>
  <description>This update for openssl-3 fixes the following issues:

- CVE-2024-6119: Fixed denial of service in X.509 name checks (bsc#1229465)

Other fixes:    
    
- FIPS: Deny SHA-1 signature verification in FIPS provider (bsc#1221365).
- FIPS: RSA keygen PCT requirements.
- FIPS: Check that the fips provider is available before setting
  it as the default provider in FIPS mode (bsc#1220523).
- FIPS: Port openssl to use jitterentropy (bsc#1220523).
- FIPS: Block non-Approved Elliptic Curves (bsc#1221786).
- FIPS: Service Level Indicator (bsc#1221365).
- FIPS: Output the FIPS-validation name and module version which uniquely
  identify the FIPS validated module (bsc#1221751).
- FIPS: Add required selftests: (bsc#1221760).
- FIPS: DH: Disable FIPS 186-4 Domain Parameters (bsc#1221821).
- FIPS: Recommendation for Password-Based Key Derivation (bsc#1221827).
- FIPS: Zero initialization required (bsc#1221752).
- FIPS: Reseed DRBG (bsc#1220690, bsc#1220693, bsc#1220696).
- FIPS: NIST SP 800-56Brev2 (bsc#1221824).
- FIPS: Approved Modulus Sizes for RSA Digital Signature for FIPS 186-4 (bsc#1221787).
- FIPS: Port openssl to use jitterentropy (bsc#1220523).
- FIPS: NIST SP 800-56Arev3 (bsc#1221822).
- FIPS: Error state has to be enforced (bsc#1221753).
</description>
</patchinfo>