wsD5BAABCAAjFiEEkd98mdFcnQdP7vQkuGrtzot7pOcFAmbqPaEFAwAAAAAACgkQuGrtzot7pOeB
xwv7Bt9nm08OrU9XBSM/1DfWBZFaPddiqCCApEmc273ex+II9nL1m/yDzXpMeJAbh7qPyVOyN4rM
as/1CkkK7xBQhRxJnev3ha3jYmix71OiYUrUdWJ5m1BV8iZAfzbI7ch4PjLlsb7JdX2hsGzNYJKm
Spuy7UeUAIst1gXP0tiSGxF4QC1h0/KdMxqxvLM7YaUBHfkcqs+VH936P2YiEGuz5JBEYVRAk6QZ
Ak8CjPROeB82rQRcaWtEw/IDf4PxQ0gvImOjq7txlTCPlHZ3PwYmyD/SBZFWkqYbiNv1jeWnq9b3
wwn38gp3yMP4ibEMuy2BERkZ56haNoTzxiWrryVJnwJkNjGmkB77V5MB2/OWHBi8fWvF8qRaNT2p
lkkKVCNGDyT739NbR/Mp3tN68iTb3EIwpmTLrhaBlGDbnz0J0RZ2JsuU2aJYBMiInL6keXj6Qhj/
ASinl0XKB/oKStJ/6qQONrF28NqijxKbR+ysOntIZnQawvhLQisrXdpC2wXa
=VQ8X
-----END PGP SIGNATURE-----
========================================================================== Ubuntu Security Notice USN-7018-1 September 18, 2024 openssl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: Several security issues were fixed in OpenSSL. Software Description: - openssl: Secure Socket Layer (SSL) cryptographic library and tools Details: Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky discovered that certain Diffie-Hellman ciphersuites in the TLS specification and implemented by OpenSSL contained a flaw. A remote attacker could possibly use this issue to eavesdrop on encrypted communications. This was fixed in this update by removing the insecure ciphersuites from OpenSSL. (CVE-2020-1968) Paul Kehrer discovered that OpenSSL incorrectly handled certain input lengths in EVP functions. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2021-23840) Elison Niven discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run. (CVE-2022-1292) Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run. (CVE-2022-2068) It was discovered that OpenSSL incorrectly handled excessively large Diffie-Hellman parameters. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-3446) Bahaa Naamneh discovered that OpenSSL incorrectly handled certain malformed PKCS12 files. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2024-0727) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS libssl1.0.0 1.0.1f-1ubuntu2.27+esm10 Available with Ubuntu Pro openssl 1.0.1f-1ubuntu2.27+esm10 Available with Ubuntu Pro After a standard system update you need to reboot your computer to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-7018-1 CVE-2020-1968, CVE-2021-23840, CVE-2022-1292, CVE-2022-2068, CVE-2023-3446, CVE-2024-0727
No comments:
Post a Comment