Title: EGI SVG 'ADVISORY' [TLP:WHITE] HIGH risk OpenSSL vulnerabilities
announced [EGI-SVG-CVE-2023-0286]
Date: 2023-02-13
Updated: 2023-02-14, 2023-04-21
Affected software and risk
==========================
Vulnerabilities announced by OpenSSL
Package : OpenSSL
CVE ID : CVE-2023-0286 and others
CVSS Score : 7.4 (Max) [R 1]
OpenSSL has announced various vulnerabilities [R 2], including one
which OpenSSL rates as 'High' risk.
Actions required/recommended
============================
Sites are recommended to update relevant component as soon as possible,
when patches for the distribution they deploy are available.
**UPDATE-2023-04-21**
Note that this is now fixed for RHEL7.
**UPDATE 2023-02-14**
We note that RedHat has downgraded to ‘Moderate’ and won’t fix for RHEL7
and derivatives, which affects CentOS7. However, we still recommend
that sites update if and when patches are available.
Component installation information
==================================
Sites running RHEL should see [R 1]
Sites running CentOS should also see [R 1]
Sites running Debian should see [R 3]
Sites running Ubuntu should see [R 4]
Sites running RockyLinux should see [R 5]
Sites running Almalinux should see [R 6]
Sites running Scientific Linux should see [R 7]
More information
================
If anyone becomes aware of any situation where any of these vulnerabilities have a significant impact on the EGI infrastructure then please inform EGI SVG.
**UPDATE 2023-02-14**
Others in the wider world are of the opinion that CVE-2023-0286 should not have been rated as 'High' risk.
E.g. [R 8].
TLP and URL
===========
** WHITE information - Unlimited distribution
- see https://go.egi.eu/tlp for
distribution restrictions **
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2023-0286
Minor updates may be made without re-distribution to the sites
Comments
========
Comments or questions should be sent to svg-rat at mailman.egi.eu
If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to
report-vulnerability at egi.eu
the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 99]
References
==========
[R 1] https://access.redhat.com/security/cve/CVE-2023-0286
[R 2] https://www.openssl.org/news/vulnerabilities.html
[R 3] https://security-tracker.debian.org/tracker/CVE-2023-0286
[R 4] http://people.canonical.com/~ubuntu-security/cve/2023/CVE-2023-0286.html
[R 5] https://errata.build.resf.org/
[R 6] https://errata.almalinux.org/
[R 7] https://www.scientificlinux.org/category/sl-errata/
[R 8] https://www.trellix.com/en-us/about/newsroom/stories/research/cve-2023-0286-the-openssl-who-cried-severity-high.html
[R 99] https://documents.egi.eu/public/ShowDocument?docid=3867
[R 99] https://documents.egi.eu/public/ShowDocument?docid=3867
Credit
======
SVG was alerted to this vulnerability by Mischa Salle
Timeline
========
Yyyy-mm-dd [EGI-SVG-2023-CVE-2023-0286]
2023-02-01 SVG alerted to plan to announce OpenSSl vulnerabilities by Mischa Salle
2023-02-07 Vulnerabilities announced by OpenSSL
2023-02-08 Discussion and assessment of the impact on the EGI infrastructure
2023-02-09 Risk Assessment completed
2023-02-13 Advisory sent to sites.
2023-04-21 Updated and placed on advisories.egi.eu
Context
=======
This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software
vulnerabilities"
The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 99] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct. The risk may also be higher or lower in other deployments depending on
how the software is used.
-----------------------------
This advisory is subject to the Creative commons licence
https://creativecommons.org/licenses/by/4.0/
and the EGI https://www.egi.eu/ Software Vulnerability Group must be credited.
-----------------------------
On behalf of the EGI SVG,