File _patchinfo of Package patchinfo.10717

<patchinfo incident="10717">
  <issue tracker="bnc" id="1097073">SLES15 GMC - system unable to boot in fips mode using fips=1 kernel boot parameter</issue>
  <issue tracker="bnc" id="1125740">[FIPS][Build 158.4] 1024 bit RSA keysize is still generated via gpg2 in fips mode</issue>
  <issue tracker="bnc" id="1138939">VUL-1: CVE-2019-12904: libgcrypt: C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes</issue>
  <issue tracker="cve" id="2019-12904"></issue>
  <category>security</category>
  <rating>moderate</rating>
  <packager>pmonrealgonzalez</packager>
  <description>This update for libgcrypt fixes the following issues:

Security issues fixed:

- CVE-2019-12904: The C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) (bsc#1138939)

Other bugfixes:

- Don't run full FIPS self-tests from constructor (bsc#1097073)
- Skip all the self-tests except for binary integrity when called
  from the constructor (bsc#1097073)
- Enforce the minimal RSA keygen size in fips mode (bsc#1125740)
- avoid executing some tests twice.
- Fixed a race condition in initialization.
- Fixed env-script-interpreter in cavs_driver.pl
- Fixed redundant fips tests in some situations causing failure to boot in
  fips mode. (bsc#1097073)

This helps during booting of the system in FIPS mode with insufficient entropy.
</description>
  <summary>Security update for libgcrypt</summary>
</patchinfo>