El-errata: New openssl updates available via Ksplice (ELSA-2021-1024)

Synopsis: ELSA-2021-1024 can now be patched using Ksplice
CVEs: CVE-2021-3449 CVE-2021-3450

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2021-1024.

INSTALLING THE UPDATES

We recommend that all users of Ksplice on OL 8 install these updates.

You can install these updates by running:

# ksplice -y user upgrade

32-bit applications should be restarted after upgrading the on-disk
openssl RPMs and statically linked applications using
openssl should be rebuilt to include these fixes.

Ksplice user-space patching requires installation of Ksplice-aware
packages and the system must be rebooted after the first installation of
these packages. Refer to the installation instructions for the Enhanced
Ksplice Client in the Ksplice User's Guide for more details. Systems
may be prepared for Ksplice patching by installing the Ksplice aware
packages in advance, prior to installing the enhanced Ksplice client.

DESCRIPTION

* CVE-2021-3450: CA certificate check bypass.

A logic error in the routine checking certificates validity allows non-CA
certificates to issue other certificates. A user with the ability to issue
non-CA certificates could use this flaw to bypass the certificate
validation chain.

* CVE-2021-3449: NULL pointer dereference on the server side during rehandshake.

Failure to reset the configured length for a freed signature algorithm
during rehandshake can lead to a NULL pointer derefence. A remote user
could use this flaw to send a specially crafted hello message in a
rehandshake to crash the server.

SUPPORT

Ksplice support is available at ksplice-support_ww@oracle.com.