SUSE-SU-2015:1179-1: moderate: Security update for libgcrypt

[sle-security-updates at lists.suse.com]

   SUSE Security Update: Security update for libgcrypt
______________________________________________________________________________

Announcement ID:    SUSE-SU-2015:1179-1
Rating:             moderate
References:         #896202 #896435 #898003 #899524 #900275 #900276 
                    #905483 #920057 #928740 #929919 
Cross-References:   CVE-2014-3591
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12
                    SUSE Linux Enterprise Server 12
                    SUSE Linux Enterprise Desktop 12
______________________________________________________________________________

   An update that solves one vulnerability and has 9 fixes is
   now available.

Description:


   This update of libgcrypt fixes one security issue and brings various FIPS
   140-2 related improvements.

   libgcrypt now uses ciphertext blinding for Elgamal decryption
   (CVE-2014-3591)

   FIPS 140-2 related changes:
   * The library performs its self-tests when the module is complete (the
     -hmac file is also installed).

   * Added a NIST 800-90a compliant DRBG.

   * Change DSA key generation to be FIPS 186-4 compliant.

   * Change RSA key generation to be FIPS 186-4 compliant.

   * Enable HW support in fips mode (bnc#896435)

   * Make DSA selftest use 2048 bit keys (bnc#898003)

   * Added ECDSA selftests and add support for it to the CAVS testing
     framework (bnc#896202)

   * Various CAVS testing improvements.


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12:

      zypper in -t patch SUSE-SLE-SDK-12-2015-296=1

   - SUSE Linux Enterprise Server 12:

      zypper in -t patch SUSE-SLE-SERVER-12-2015-296=1

   - SUSE Linux Enterprise Desktop 12:

      zypper in -t patch SUSE-SLE-DESKTOP-12-2015-296=1

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 12 (ppc64le s390x x86_64):

      libgcrypt-debugsource-1.6.1-13.1
      libgcrypt-devel-1.6.1-13.1
      libgcrypt-devel-debuginfo-1.6.1-13.1

   - SUSE Linux Enterprise Server 12 (ppc64le s390x x86_64):

      libgcrypt-debugsource-1.6.1-13.1
      libgcrypt20-1.6.1-13.1
      libgcrypt20-debuginfo-1.6.1-13.1
      libgcrypt20-hmac-1.6.1-13.1

   - SUSE Linux Enterprise Server 12 (s390x x86_64):

      libgcrypt20-32bit-1.6.1-13.1
      libgcrypt20-debuginfo-32bit-1.6.1-13.1
      libgcrypt20-hmac-32bit-1.6.1-13.1

   - SUSE Linux Enterprise Desktop 12 (x86_64):

      libgcrypt-debugsource-1.6.1-13.1
      libgcrypt20-1.6.1-13.1
      libgcrypt20-32bit-1.6.1-13.1
      libgcrypt20-debuginfo-1.6.1-13.1
      libgcrypt20-debuginfo-32bit-1.6.1-13.1


References:

   https://www.suse.com/security/cve/CVE-2014-3591.html
   https://bugzilla.suse.com/896202
   https://bugzilla.suse.com/896435
   https://bugzilla.suse.com/898003
   https://bugzilla.suse.com/899524
   https://bugzilla.suse.com/900275
   https://bugzilla.suse.com/900276
   https://bugzilla.suse.com/905483
   https://bugzilla.suse.com/920057
   https://bugzilla.suse.com/928740
   https://bugzilla.suse.com/929919