File _patchinfo of Package patchinfo.36134

<patchinfo incident="36134">
  <issue tracker="bnc" id="1224265">[FIPS 140-3][OpenSSL 1.1.1]  PCT required</issue>
  <issue tracker="bnc" id="1224266">[FIPS 140-3][OpenSSL 1.1.1] Consider deprecating sha1</issue>
  <issue tracker="bnc" id="1224275">[FIPS 140-3][OpenSSL 1.1.1]  PSS length</issue>
  <issue tracker="bnc" id="1224264">[FIPS 140-3][OpenSSL 1.1.1] Selftest and safe prime group</issue>
  <issue tracker="bnc" id="1224269">[FIPS 140-3][OpenSSL 1.1.1]  X9.31 scheme is not approved for signatures</issue>
  <issue tracker="bnc" id="1228623">[FIPS 140-3][OpenSSL 1.1.1] HMAC input shall be bigger than 112 bits</issue>
  <issue tracker="bnc" id="1224270">[FIPS 140-3][OpenSSL 1.1.1]  enforce KDF in FIPS style</issue>
  <issue tracker="bnc" id="1224273">[FIPS 140-3][OpenSSL 1.1.1]   disalow RSA sigVER with 1024</issue>
  <issue tracker="bnc" id="1228618">[FIPS 140-3][OpenSSL 1.1.1] AES GCM implementation</issue>
  <issue tracker="bnc" id="1224258">[FIPS 140-3][OpenSSL 1.1.1]  DRBG component chaining</issue>
  <issue tracker="bnc" id="1228619">[FIPS 140-3][OpenSSL 1.1.1] TLS KDF function improvement</issue>
  <issue tracker="bnc" id="1224272">[FIPS 140-3][OpenSSL 1.1.1]  signature procedures regarding hashing and sign/verify</issue>
  <issue tracker="bnc" id="1224271">[FIPS 140-3][OpenSSL 1.1.1]  PKCSv1.5 and shake</issue>
  <issue tracker="bnc" id="1224267">[FIPS 140-3][OpenSSL 1.1.1]  remove non-approved KDF types</issue>
  <issue tracker="bnc" id="1220262">VUL-0: CVE-2023-50782: openssl: consider backporting implicit rejection in PKCS#1 v1.5</issue>
  <issue tracker="bnc" id="1224260">[FIPS 140-3][OpenSSL 1.1.1]  change CRNG buf size</issue>
  <issue tracker="bnc" id="1224268">[FIPS 140-3][OpenSSL 1.1.1] Suggestion to remove drbg implementation files</issue>
  <issue tracker="cve" id="2023-50782"/>
  <packager>pmonrealgonzalez</packager>
  <rating>moderate</rating>
  <category>security</category>
  <summary>Security update for openssl-1_1</summary>
  <description>This update for openssl-1_1 fixes the following issues:

Security fixes:

- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)

Other fixes:

- FIPS: AES GCM external IV implementation (bsc#1228618)
- FIPS: Mark PBKDF2 and HKDF HMAC input keys with size &gt;= 112 bits as approved in the SLI. (bsc#1228623)
- FIPS: Enforce KDF in FIPS style (bsc#1224270)
- FIPS: Mark HKDF and TLSv1.3 KDF as approved in the SLI (bsc#1228619)
- FIPS: The X9.31 scheme is not approved for RSA signature operations in FIPS 186-5. (bsc#1224269)
- FIPS: Differentiate the PSS length requirements (bsc#1224275)
- FIPS: Mark sigGen and sigVer primitives as non-approved (bsc#1224272)
- FIPS: Disable PKCSv1.5 and shake in FIPS mode (bsc#1224271)
- FIPS: Mark SHA1 as non-approved in the SLI (bsc#1224266)
- FIPS: DH FIPS selftest and safe prime group (bsc#1224264)
- FIPS: Remove not needed FIPS DRBG files (bsc#1224268)
- FIPS: Add Pair-wise Consistency Test when generating DH key (bsc#1224265)
- FIPS: Disallow non-approved KDF types (bsc#1224267)
- FIPS: Disallow RSA sigVer with 1024 and ECDSA sigVer/keyVer P-192 (bsc#1224273)
- FIPS: DRBG component chaining (bsc#1224258)
- FIPS: Align CRNGT_BUFSIZ with Jitter RNG output size (bsc#1224260)
</description>
</patchinfo>