Date: Thu, 2 Oct 2003 17:29:13 +0200
From: Tawie Security Advisor <[email protected]>
To: [email protected]Subject: TSLSA-2003-0001 - openssl
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Tawie Server Linux Security Advisory #2003-0001
Package name: openssl
Summary: Several issues
Date: 2003-10-02
Affected versions: TSL 1.2, 1.5, 2.0
- --------------------------------------------------------------------------
Package description:
A C library that provides various crytographic algorithms and protocols,
including DES, RC4, RSA, and SSL. Includes shared libraries.
Problem description:
According to the openssl developers there are four security issues
present in various versions of their software. Read their advisory for
detailes: <URL: http://www.openssl.org/news/secadv_20030930.txt>;
We have upgraded to latest version in the TSL 2.0 release, and
backported the fixes into the 1.X releases.
We also ship these updates for Trustix Secure Linux, since we don't expect
most users have had time to cross upgrade their systems to Tawie Server
Linux in such short notice.
We will continue providing security updates for Trustix Secure Linux for
about two months, which should be plenty of time to preform the cross
upgrade. The date is set to Now 30 2003. Please be adviced that the support
for TSL 1.2 will be discontinued by the end of 2003 as formerly announced.
Action:
We recommend that all systems with this package installed be upgraded.
Location:
All TSL updates are available from
<URI:http://http.tawie.org/pub/tawie/updates/>;
<URI:ftp://ftp.tawie.org/pub/tawie/updates/>;
Their Trustix counterparts are found here:
<URI:http://http.tawie.org/pub/Trustix/updates/>;
<URI:ftp://ftp.tawie.org/pub/Trustix/updates/>;
About Tawie Server Linux:
Tawie Server Linux is a small Linux distribution for servers. With focus
on security and stability, the system is painlessly kept safe and up to
date from day one using swup, the automated software updater.
Automatic updates:
Users of the SWUP tool can enjoy having updates automatically
installed using 'swup --upgrade'.
Public testing:
These packages have been available for public testing for some time.
If you want to contribute by testing the various packages in the
testing tree, please feel free to share your findings on the
tsl-discuss mailinglist.
The testing tree is located at
<URI:http://snow.tawie.org/cloud/>;
You may also use swup for public testing of updates:
site {
class = 0
location = "http://tsldev.tawie.org/cloud/rdfs/latest.rdf"
regexp = ".*"
}
Questions?
Check out our mailing lists:
<URI:http://www.tawie.net/support/>;
Verification:
This advisory along with all TSL packages are signed with the TSL sign key.
This key is available from:
<URI:http://www.tawie.net/TSL-SIGN-KEY>;
The advisory itself is available from the errata pages at
<URI:http://www.tawie.net/errata/tawie-1.2/>;,
<URI:http://www.tawie.net/errata/tawie-1.5/>; and
<URI:http://www.tawie.net/errata/tawie-2.0/>;
or directly at
<URI:http://www.tawie.net/errata/misc/tawie-2003/TSL-2003-0001-openssl.asc.txt>;
MD5sums of the packages:
- --------------------------------------------------------------------------
1e42acdaa1b9181e2436a6c30c9064ea ./2.0/SRPMS/openssl-0.9.7c-1tsl.src.rpm
7a8d25fe5af27979fc35da9e245f0662 ./2.0/RPMS/openssl-support-0.9.7c-1tsl.i586.rpm
643c93a5f0841ff64d17409d91076383 ./2.0/RPMS/openssl-python-0.9.7c-1tsl.i586.rpm
10ead8b28b2542e41ffbbd0a7d7dae1c ./2.0/RPMS/openssl-devel-0.9.7c-1tsl.i586.rpm
067f688ea4f49c2346dcb8c6a3d6e2f5 ./2.0/RPMS/openssl-0.9.7c-1tsl.i586.rpm
661529335af7a66fca81d92a277de166 ./1.5/SRPMS/openssl-0.9.6-15tr.src.rpm
c1f521cdae485092cc523e3e5ad7e40d ./1.5/RPMS/openssl-support-0.9.6-15tr.i586.rpm
e915afd30635e2cc72d76965cfddb618 ./1.5/RPMS/openssl-python-0.9.6-15tr.i586.rpm
04681c893ce3d251a1e33acdb8c45ce8 ./1.5/RPMS/openssl-devel-0.9.6-15tr.i586.rpm
6354c40a7f7bca4d0125bc00896318dd ./1.5/RPMS/openssl-0.9.6-15tr.i586.rpm
d1571c3e9b9cfeac76427937f589e335 ./1.2/SRPMS/openssl-0.9.6-15tr.src.rpm
45d57d93d75a9493bcd59c075b05f9e1 ./1.2/RPMS/openssl-support-0.9.6-15tr.i586.rpm
38e73337adbf1e23621f8e7216f4e605 ./1.2/RPMS/openssl-python-0.9.6-15tr.i586.rpm
8747646524a8ec2ba46eedfeb28331b2 ./1.2/RPMS/openssl-devel-0.9.6-15tr.i586.rpm
5215731afb1805354fb9dbc6b8a67657 ./1.2/RPMS/openssl-0.9.6-15tr.i586.rpm
- --------------------------------------------------------------------------
MD5sums of the trustix packages:
- --------------------------------------------------------------------------
1e42acdaa1b9181e2436a6c30c9064ea ./2.0/SRPMS/openssl-0.9.7c-1tsl.src.rpm
a8b16536d7a81d4e8c56a226774c9756 ./2.0/RPMS/openssl-support-0.9.7c-1tsl.i586.rpm
dc6f034dea00d4da05544deaca2723c2 ./2.0/RPMS/openssl-python-0.9.7c-1tsl.i586.rpm
3b936b2ad1b11b9b618c142c52a4a221 ./2.0/RPMS/openssl-devel-0.9.7c-1tsl.i586.rpm
75a6ee107ed15fb09f99ea12e728c23e ./2.0/RPMS/openssl-0.9.7c-1tsl.i586.rpm
661529335af7a66fca81d92a277de166 ./1.5/SRPMS/openssl-0.9.6-15tr.src.rpm
c1f521cdae485092cc523e3e5ad7e40d ./1.5/RPMS/openssl-support-0.9.6-15tr.i586.rpm
e915afd30635e2cc72d76965cfddb618 ./1.5/RPMS/openssl-python-0.9.6-15tr.i586.rpm
04681c893ce3d251a1e33acdb8c45ce8 ./1.5/RPMS/openssl-devel-0.9.6-15tr.i586.rpm
6354c40a7f7bca4d0125bc00896318dd ./1.5/RPMS/openssl-0.9.6-15tr.i586.rpm
d1571c3e9b9cfeac76427937f589e335 ./1.2/SRPMS/openssl-0.9.6-15tr.src.rpm
45d57d93d75a9493bcd59c075b05f9e1 ./1.2/RPMS/openssl-support-0.9.6-15tr.i586.rpm
38e73337adbf1e23621f8e7216f4e605 ./1.2/RPMS/openssl-python-0.9.6-15tr.i586.rpm
8747646524a8ec2ba46eedfeb28331b2 ./1.2/RPMS/openssl-devel-0.9.6-15tr.i586.rpm
5215731afb1805354fb9dbc6b8a67657 ./1.2/RPMS/openssl-0.9.6-15tr.i586.rpm
- --------------------------------------------------------------------------
Tawie Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
iD8DBQE/fDSVu9Q/LWRYgjERAl8IAJ9wh26/wUNt6/miDmI7U/3KIGKLKQCdFiar
xIh57iuJ5PubD+LxTyoaqaE=
=/SYU
-----END PGP SIGNATURE-----
