Tuesday, September 17, 2024

[USN-7018-1] OpenSSL vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmbqPaEFAwAAAAAACgkQuGrtzot7pOeB
xwv7Bt9nm08OrU9XBSM/1DfWBZFaPddiqCCApEmc273ex+II9nL1m/yDzXpMeJAbh7qPyVOyN4rM
as/1CkkK7xBQhRxJnev3ha3jYmix71OiYUrUdWJ5m1BV8iZAfzbI7ch4PjLlsb7JdX2hsGzNYJKm
Spuy7UeUAIst1gXP0tiSGxF4QC1h0/KdMxqxvLM7YaUBHfkcqs+VH936P2YiEGuz5JBEYVRAk6QZ
Ak8CjPROeB82rQRcaWtEw/IDf4PxQ0gvImOjq7txlTCPlHZ3PwYmyD/SBZFWkqYbiNv1jeWnq9b3
wwn38gp3yMP4ibEMuy2BERkZ56haNoTzxiWrryVJnwJkNjGmkB77V5MB2/OWHBi8fWvF8qRaNT2p
lkkKVCNGDyT739NbR/Mp3tN68iTb3EIwpmTLrhaBlGDbnz0J0RZ2JsuU2aJYBMiInL6keXj6Qhj/
ASinl0XKB/oKStJ/6qQONrF28NqijxKbR+ysOntIZnQawvhLQisrXdpC2wXa
=VQ8X
-----END PGP SIGNATURE-----

==========================================================================  Ubuntu Security Notice USN-7018-1  September 18, 2024    openssl vulnerabilities  ==========================================================================    A security issue affects these releases of Ubuntu and its derivatives:    - Ubuntu 14.04 LTS    Summary:    Several security issues were fixed in OpenSSL.    Software Description:  - openssl: Secure Socket Layer (SSL) cryptographic library and tools    Details:    Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky  discovered that certain Diffie-Hellman ciphersuites in the TLS  specification and implemented by OpenSSL contained a flaw. A remote  attacker could possibly use this issue to eavesdrop on encrypted  communications. This was fixed in this update by removing the insecure  ciphersuites from OpenSSL. (CVE-2020-1968)    Paul Kehrer discovered that OpenSSL incorrectly handled certain input  lengths in EVP functions. A remote attacker could possibly use this issue  to cause OpenSSL to crash, resulting in a denial of service.  (CVE-2021-23840)    Elison Niven discovered that OpenSSL incorrectly handled the c_rehash  script. A local attacker could possibly use this issue to execute arbitrary  commands when c_rehash is run. (CVE-2022-1292)    Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the  c_rehash script. A local attacker could possibly use this issue to execute  arbitrary commands when c_rehash is run. (CVE-2022-2068)    It was discovered that OpenSSL incorrectly handled excessively large  Diffie-Hellman parameters. An attacker could possibly use this issue  to cause a denial of service. (CVE-2023-3446)    Bahaa Naamneh discovered that OpenSSL incorrectly handled certain malformed  PKCS12 files. A remote attacker could possibly use this issue to cause  OpenSSL to crash, resulting in a denial of service. (CVE-2024-0727)    Update instructions:    The problem can be corrected by updating your system to the following  package versions:    Ubuntu 14.04 LTS    libssl1.0.0                     1.0.1f-1ubuntu2.27+esm10                                    Available with Ubuntu Pro    openssl                         1.0.1f-1ubuntu2.27+esm10                                    Available with Ubuntu Pro    After a standard system update you need to reboot your computer to make  all the necessary changes.    References:    https://ubuntu.com/security/notices/USN-7018-1    CVE-2020-1968, CVE-2021-23840, CVE-2022-1292, CVE-2022-2068,    CVE-2023-3446, CVE-2024-0727    

No comments:

Post a Comment