openssl-libs-3.2.2-6.el9 RPM for x86_64

From CentOS Stream 9 BaseOS for x86_64

OpenSSL is a toolkit for supporting cryptography. The openssl-libs
package contains the libraries that are used by various applications which
support cryptographic algorithms and protocols.

Provides

• openssl-libs
• config(openssl-libs)
• libcrypto.so.3()(64bit)
• libcrypto.so.3(OPENSSL_3.0.0)(64bit)
• libcrypto.so.3(OPENSSL_3.0.1)(64bit)
• libcrypto.so.3(OPENSSL_3.0.3)(64bit)
• libcrypto.so.3(OPENSSL_3.0.8)(64bit)
• libcrypto.so.3(OPENSSL_3.0.9)(64bit)
• libcrypto.so.3(OPENSSL_3.1.0)(64bit)
• libcrypto.so.3(OPENSSL_3.2.0)(64bit)
• libssl.so.3()(64bit)
• libssl.so.3(OPENSSL_3.0.0)(64bit)
• libssl.so.3(OPENSSL_3.2.0)(64bit)
• openssl-libs(x86-64)

Requires

• ca-certificates >= 2008-5
• config(openssl-libs) = 1:3.2.2-6.el9
• crypto-policies >= 20180730
• libc.so.6()(64bit)
• libc.so.6(GLIBC_2.12)(64bit)
• libc.so.6(GLIBC_2.14)(64bit)
• libc.so.6(GLIBC_2.15)(64bit)
• libc.so.6(GLIBC_2.16)(64bit)
• libc.so.6(GLIBC_2.17)(64bit)
• libc.so.6(GLIBC_2.2.5)(64bit)
• libc.so.6(GLIBC_2.25)(64bit)
• libc.so.6(GLIBC_2.3)(64bit)
• libc.so.6(GLIBC_2.3.2)(64bit)
• libc.so.6(GLIBC_2.3.4)(64bit)
• libc.so.6(GLIBC_2.33)(64bit)
• libc.so.6(GLIBC_2.34)(64bit)
• libc.so.6(GLIBC_2.4)(64bit)
• libc.so.6(GLIBC_2.7)(64bit)
• libcrypto.so.3()(64bit)
• libcrypto.so.3(OPENSSL_3.0.0)(64bit)
• libcrypto.so.3(OPENSSL_3.0.1)(64bit)
• libcrypto.so.3(OPENSSL_3.0.3)(64bit)
• libcrypto.so.3(OPENSSL_3.2.0)(64bit)
• libz.so.1()(64bit)
• rpmlib(CompressedFileNames) <= 3.0.4-1
• rpmlib(FileDigests) <= 4.6.0-1
• rpmlib(PayloadFilesHavePrefix) <= 4.0-1
• rpmlib(PayloadIsZstd) <= 5.4.18-1
• rtld(GNU_HASH)

License

ASL 2.0

Changelog

* Thu Sep 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-6
  - rebuilt
    Related: RHEL-55339
* Wed Sep 04 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-5
  - Fix CVE-2024-6119: Possible denial of service in X.509 name checks
    Resolves: RHEL-55339
* Wed Aug 21 2024 Clemens Lang <cllang@redhat.com> - 1:3.2.2-4
  - Fix CVE-2024-5535: SSL_select_next_proto buffer overread
    Resolves: RHEL-45657
* Sat Jun 22 2024 Daiki Ueno <dueno@redhat.com> - 1:3.2.2-3
  - Replace HKDF backward compatibility patch with the official one
    Related: RHEL-40823
* Wed Jun 12 2024 Daiki Ueno <dueno@redhat.com> - 1:3.2.2-2
  - Add workaround for EVP_PKEY_CTX_add1_hkdf_info with older providers
    Resolves: RHEL-40823
* Wed Jun 05 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-1
  - Rebase to OpenSSL 3.2.2. Fixes CVE-2024-2511, CVE-2024-4603, CVE-2024-4741,
    and Minerva attack.
    Resolves: RHEL-32148
    Resolves: RHEL-36792
    Resolves: RHEL-38514
    Resolves: RHEL-39111
* Thu May 23 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.1-2
  - Update RNG changing for FIPS purpose
    Resolves: RHEL-35380
* Wed Apr 03 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.1-1
  - Rebasing OpenSSL to 3.2.1
    Resolves: RHEL-26271
* Wed Feb 21 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-27
  - Use certified FIPS module instead of freshly built one in Red Hat distribution
    Related: RHEL-23474
* Tue Nov 21 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-26
  - Avoid implicit function declaration when building openssl
    Related: RHEL-1780
  - In FIPS mode, prevent any other operations when rsa_keygen_pairwise_test fails
    Resolves: RHEL-17104
  - Add a directory for OpenSSL providers configuration
    Resolves: RHEL-17193
  - Eliminate memory leak in OpenSSL when setting elliptic curves on SSL context
    Resolves: RHEL-19515
  - POLY1305 MAC implementation corrupts vector registers on PowerPC (CVE-2023-6129)
    Resolves: RHEL-21151
  - Excessive time spent checking invalid RSA public keys (CVE-2023-6237)
    Resolves: RHEL-21654
  - SSL ECDHE Kex fails when pkcs11 engine is set in config file
    Resolves: RHEL-20249
  - Denial of service via null dereference in PKCS#12
    Resolves: RHEL-22486
  - Use certified FIPS module instead of freshly built one in Red Hat distribution
    Resolves: RHEL-23474
* Mon Oct 16 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-25
  - Provide relevant diagnostics when FIPS checksum is corrupted
    Resolves: RHEL-5317
  - Don't limit using SHA1 in KDFs in non-FIPS mode.
    Resolves: RHEL-5295
  - Provide empty evp_properties section in main OpenSSL configuration file
    Resolves: RHEL-11439
  - Avoid implicit function declaration when building openssl
    Resolves: RHEL-1780
  - Forbid explicit curves when created via EVP_PKEY_fromdata
    Resolves: RHEL-5304
  - AES-SIV cipher implementation contains a bug that causes it to ignore empty
    associated data entries (CVE-2023-2975)
    Resolves: RHEL-5302
  - Excessive time spent checking DH keys and parameters (CVE-2023-3446)
    Resolves: RHEL-5306
  - Excessive time spent checking DH q parameter value (CVE-2023-3817)
    Resolves: RHEL-5308
  - Fix incorrect cipher key and IV length processing (CVE-2023-5363)
    Resolves: RHEL-13251
  - Switch explicit FIPS indicator for RSA-OAEP to approved following
    clarification with CMVP
    Resolves: RHEL-14083
  - Backport the check required by SP800-56Br2 6.4.1.2.1 (3.c)
    Resolves: RHEL-14083
  - Add missing ECDH Public Key Check in FIPS mode
    Resolves: RHEL-15990
  - Excessive time spent in DH check/generation with large Q parameter value (CVE-2023-5678)
    Resolves: RHEL-15954
* Wed Jul 12 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-24
  - Make FIPS module configuration more crypto-policies friendly
    Related: rhbz#2216256
* Tue Jul 11 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-23
  - Add a workaround for lack of EMS in FIPS mode
    Resolves: rhbz#2216256
* Thu Jul 06 2023 Sahana Prasad <sahana@redhat.com> - 1:3.0.7-22
  - Remove unsupported curves from nist_curves.
    Resolves: rhbz#2069336
* Mon Jun 26 2023 Sahana Prasad <sahana@redhat.com> - 1:3.0.7-21
  - Remove the listing of brainpool curves in FIPS mode.
    Related: rhbz#2188180
* Tue May 30 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-20
  - Fix possible DoS translating ASN.1 object identifiers
    Resolves: CVE-2023-2650
  - Release the DRBG in global default libctx early
    Resolves: rhbz#2211340
* Mon May 22 2023 Clemens Lang <cllang@redhat.com> - 1:3.0.7-19
  - Re-enable DHX keys in FIPS mode, disable FIPS 186-4 parameter validation and generation in FIPS mode
    Resolves: rhbz#2169757
* Thu May 18 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-18
  - Use OAEP padding and aes-128-cbc by default in cms command in FIPS mode
    Resolves: rhbz#2160797
* Tue May 09 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-17
  - Enforce using EMS in FIPS mode - better alerts
    Related: rhbz#2157951
* Tue May 02 2023 Sahana Prasad <sahana@redhat.com> - 1:3.0.7-16
  - Upload new upstream sources without manually hobbling them.
  - Remove the hobbling script as it is redundant. It is now allowed to ship
    the sources of patented EC curves, however it is still made unavailable to use
    by compiling with the 'no-ec2m' Configure option. The additional forbidden
    curves such as P-160, P-192, wap-tls curves are manually removed by updating
    0011-Remove-EC-curves.patch.
  - Enable Brainpool curves.
  - Apply the changes to ec_curve.c and  ectest.c as a new patch
    0010-Add-changes-to-ectest-and-eccurve.patch instead of replacing them.
  - Modify 0011-Remove-EC-curves.patch to allow Brainpool curves.
  - Modify 0011-Remove-EC-curves.patch to allow code under macro OPENSSL_NO_EC2M.
    Resolves: rhbz#2130618, rhbz#2188180
* Fri Apr 28 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-15
  - Backport implicit rejection for RSA PKCS#1 v1.5 encryption
    Resolves: rhbz#2153471
* Fri Apr 21 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-14
  - Input buffer over-read in AES-XTS implementation on 64 bit ARM
    Resolves: rhbz#2188554
* Tue Apr 18 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-13
  - Enforce using EMS in FIPS mode
    Resolves: rhbz#2157951
  - Fix excessive resource usage in verifying X509 policy constraints
    Resolves: rhbz#2186661
  - Fix invalid certificate policies in leaf certificates check
    Resolves: rhbz#2187429
  - Certificate policy check not enabled
    Resolves: rhbz#2187431
  - OpenSSL rsa_verify_recover key length checks in FIPS mode
    Resolves: rhbz#2186819
* Fri Mar 24 2023 Clemens Lang <cllang@redhat.com> - 1:3.0.7-12
  - Change explicit FIPS indicator for RSA decryption to unapproved
    Resolves: rhbz#2179379
* Mon Mar 20 2023 Clemens Lang <cllang@redhat.com> - 1:3.0.7-11
  - Add missing reference to patchfile to add explicit FIPS indicator to RSA
    encryption and RSASVE and fix the gettable parameter list for the RSA
    asymmetric cipher implementation.
    Resolves: rhbz#2179379
* Fri Mar 17 2023 Clemens Lang <cllang@redhat.com> - 1:3.0.7-10
  - Add explicit FIPS indicator to RSA encryption and RSASVE
    Resolves: rhbz#2179379
* Thu Mar 16 2023 Clemens Lang <cllang@redhat.com> - 1:3.0.7-9
  - Fix explicit FIPS indicator for X9.42 KDF when used with output lengths < 14 bytes
    Resolves: rhbz#2175864
* Thu Mar 16 2023 Clemens Lang <cllang@redhat.com> - 1:3.0.7-8
  - Fix Wpointer-sign compiler warning 
    Resolves: rhbz#2178034
* Tue Mar 14 2023 Clemens Lang <cllang@redhat.com> - 1:3.0.7-7
  - Add explicit FIPS indicators to key derivation functions
    Resolves: rhbz#2175860 rhbz#2175864
  - Zeroize FIPS module integrity check MAC after check
    Resolves: rhbz#2175873
  - Add explicit FIPS indicator for IV generation in AES-GCM
    Resolves: rhbz#2175868
  - Add explicit FIPS indicator for PBKDF2, use test vector with FIPS-compliant
    salt in PBKDF2 FIPS self-test
    Resolves: rhbz#2178137
  - Limit RSA_NO_PADDING for encryption and signature in FIPS mode
    Resolves: rhbz#2178029
  - Pairwise consistency tests should use Digest+Sign/Verify
    Resolves: rhbz#2178034
  - Forbid DHX keys import in FIPS mode
    Resolves: rhbz#2178030
  - DH PCT should abort on failure
    Resolves: rhbz#2178039
  - Increase RNG seeding buffer size to 32
    Related: rhbz#2168224
* Wed Mar 08 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-6
  - Fixes RNG slowdown in FIPS mode
    Resolves: rhbz#2168224
* Wed Feb 08 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-5
  - Fixed X.509 Name Constraints Read Buffer Overflow
    Resolves: CVE-2022-4203
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed Invalid pointer dereference in d2i_PKCS7 functions
    Resolves: CVE-2023-0216
  - Fixed NULL dereference validating DSA public key
    Resolves: CVE-2023-0217
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286
  - Fixed NULL dereference during PKCS7 data verification
    Resolves: CVE-2023-0401
* Wed Jan 11 2023 Clemens Lang <cllang@redhat.com> - 1:3.0.7-4
  - Disallow SHAKE in RSA-OAEP decryption in FIPS mode
    Resolves: rhbz#2142121
* Thu Jan 05 2023 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-3
  - Refactor OpenSSL fips module MAC verification
    Resolves: rhbz#2157965
* Thu Nov 24 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-2
  - Various provider-related imrovements necessary for PKCS#11 provider correct operations
    Resolves: rhbz#2142517
  - We should export 2 versions of OPENSSL_str[n]casecmp to be compatible with upstream
    Resolves: rhbz#2133809
  - Removed recommended package for openssl-libs
    Resolves: rhbz#2093804
  - Adjusting include for the FIPS_mode macro
    Resolves: rhbz#2083879
  - Backport of ppc64le Montgomery multiply enhancement
    Resolves: rhbz#2130708
  - Fix explicit indicator for PSS salt length in FIPS mode when used with
    negative magic values
    Resolves: rhbz#2142087
  - Update change to default PSS salt length with patch state from upstream 
    Related: rhbz#2142087
* Tue Nov 22 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.7-1
  - Rebasing to OpenSSL 3.0.7
    Resolves: rhbz#2129063
* Mon Nov 14 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-44
  - SHAKE-128/256 are not allowed with RSA in FIPS mode
    Resolves: rhbz#2144010
  - Avoid memory leaks in TLS
    Resolves: rhbz#2144008
  - FIPS RSA CRT tests must use correct parameters
    Resolves: rhbz#2144006
  - FIPS-140-3 permits only SHA1, SHA256, and SHA512 for DRBG-HASH/DRBG-HMAC
    Resolves: rhbz#2144017
  - Remove support for X9.31 signature padding in FIPS mode
    Resolves: rhbz#2144015
  - Add explicit indicator for SP 800-108 KDFs with short key lengths
    Resolves: rhbz#2144019
  - Add explicit indicator for HMAC with short key lengths
    Resolves: rhbz#2144000
  - Set minimum password length for PBKDF2 in FIPS mode
    Resolves: rhbz#2144003
  - Add explicit indicator for PSS salt length in FIPS mode
    Resolves: rhbz#2144012
  - Clamp default PSS salt length to digest size for FIPS 186-4 compliance
    Related: rhbz#2144012
  - Forbid short RSA keys for key encapsulation/decapsulation in FIPS mode
    Resolves: rhbz#2145170
* Tue Nov 01 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-43
  - CVE-2022-3602: X.509 Email Address Buffer Overflow
  - CVE-2022-3786: X.509 Email Address Buffer Overflow
    Resolves: CVE-2022-3602
* Wed Oct 26 2022 Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.0.1-42
  - CVE-2022-3602: X.509 Email Address Buffer Overflow
    Resolves: CVE-2022-3602 (rhbz#2137723)

Files

/etc/pki/tls
/etc/pki/tls/certs
/etc/pki/tls/ct_log_list.cnf
/etc/pki/tls/fips_local.cnf
/etc/pki/tls/misc
/etc/pki/tls/openssl.cnf
/etc/pki/tls/openssl.d
/etc/pki/tls/private
/usr/lib/.build-id
/usr/lib/.build-id/1b
/usr/lib/.build-id/1b/dac0aa6062f363b29d31f496ee8bc0dba63868
/usr/lib/.build-id/2c
/usr/lib/.build-id/2c/a2e58fda05fa2f3ff70f51a659450c7d904747
/usr/lib/.build-id/54
/usr/lib/.build-id/54/b44373487c1d67fbe96128c271f78c858358d0
/usr/lib/.build-id/55
/usr/lib/.build-id/55/4d3852a30c6e71f422209a9cfcf1e089a1fd4b
/usr/lib/.build-id/b5
/usr/lib/.build-id/b5/8d4020667bc516af80d3f2ffd2951eb3cef8cd
/usr/lib/.build-id/d7
/usr/lib/.build-id/d7/f4d28b0dae30c7d358a36b50efaf35cd62ed18
/usr/lib/.build-id/e0
/usr/lib/.build-id/e0/09e033af11ce86239594c9cc44fb4c27c7c33d
/usr/lib/.build-id/e3
/usr/lib/.build-id/e3/b2318f66cb9b47adfc8a7d78ec5d80d37ea56c
/usr/lib64/engines-3
/usr/lib64/engines-3/afalg.so
/usr/lib64/engines-3/capi.so
/usr/lib64/engines-3/loader_attic.so
/usr/lib64/engines-3/padlock.so
/usr/lib64/libcrypto.so.3
/usr/lib64/libcrypto.so.3.2.2
/usr/lib64/libssl.so.3
/usr/lib64/libssl.so.3.2.2
/usr/lib64/ossl-modules
/usr/lib64/ossl-modules/fips.so
/usr/lib64/ossl-modules/legacy.so
/usr/share/licenses/openssl-libs
/usr/share/licenses/openssl-libs/LICENSE.txt

Generated by rpm2html 1.8.1

Fabrice Bellet, Tue Dec 17 08:30:58 2024