Detections
Analytics

SUSE SLED15: libopenssl-3-devel / libopenssl-3-devel-32bit / libopenssl3 / etc (SUSE-SU-2023:0312-1)

high Nessus Plugin ID 171127

Language:

Synopsis

The remote SUSE host is missing one or more security updates.

Description

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0312-1 advisory.

 Security fixes:

 - CVE-2023-0286: Fixed X.400 address type confusion in X.509 GENERAL_NAME_cmp for x400Address (bsc#1207533).
 - CVE-2023-0401: Fixed NULL pointer dereference during PKCS7 data verification (bsc#1207541).
 - CVE-2023-0217: Fixed NULL pointer dereference validating DSA public key (bsc#1207540).
 - CVE-2023-0216: Fixed invalid pointer dereference in d2i_PKCS7 functions (bsc#1207539).
 - CVE-2023-0215: Fixed use-after-free following BIO_new_NDEF() (bsc#1207536).
 - CVE-2022-4450: Fixed double free after calling PEM_read_bio_ex() (bsc#1207538).
 - CVE-2022-4304: Fixed timing Oracle in RSA Decryption (bsc#1207534).
 - CVE-2022-4203: Fixed read Buffer Overflow with X.509 Name Constraints (bsc#1207535).

 Non-security fixes:

 - Fix SHA, SHAKE, KECCAK ASM and EC ASM flag passing (bsc#1206222).
 - Enable zlib compression support (bsc#1195149).
 - Add crypto-policies dependency.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://bugzilla.suse.com/1195149

https://bugzilla.suse.com/1206222

https://bugzilla.suse.com/1207533

https://bugzilla.suse.com/1207534

https://bugzilla.suse.com/1207535

https://bugzilla.suse.com/1207536

https://bugzilla.suse.com/1207538

https://bugzilla.suse.com/1207539

https://bugzilla.suse.com/1207540

https://bugzilla.suse.com/1207541

https://www.suse.com/security/cve/CVE-2022-4203

https://www.suse.com/security/cve/CVE-2022-4304

https://www.suse.com/security/cve/CVE-2022-4450

https://www.suse.com/security/cve/CVE-2023-0215

https://www.suse.com/security/cve/CVE-2023-0216

https://www.suse.com/security/cve/CVE-2023-0217

https://www.suse.com/security/cve/CVE-2023-0286

https://www.suse.com/security/cve/CVE-2023-0401

http://www.nessus.org/u?17f86bcf

Plugin Details

Severity: High

ID: 171127

File Name: suse_SU-2023-0312-1.nasl

Version: 1.8

Type: Local

Agent: unix

Published: 2/8/2023

Updated: 6/26/2026

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7

Percentile: 98.33

CVSS v2

Risk Factor: High

Base Score: 7.1

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2023-0286

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:suse_linux:15, p-cpe:/a:novell:suse_linux:libopenssl-3-devel, p-cpe:/a:novell:suse_linux:libopenssl3, p-cpe:/a:novell:suse_linux:openssl-3

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 2/7/2023

Vulnerability Publication Date: 12/15/2022

Reference Information

CVE: CVE-2022-4203, CVE-2022-4304, CVE-2022-4450, CVE-2023-0215, CVE-2023-0216, CVE-2023-0217, CVE-2023-0286, CVE-2023-0401

SuSE: SUSE-SU-2023:0312-1