Alerts This Week
Warning Icon 1 1,071
Alerts This Week
Warning Icon 1 1,071

Ubuntu 22.04 LTS: USN-5710-1 Critical OpenSSL Denial Of Service

ubuntu
Calendar Grey November 1, 2022
Dist Ubuntu Esm H88
Debian Security Announcement DSA-5078-1 releases vital OpenSSL enhancements to mitigate potential exploitation risks linked to service interruptions.
Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

It was discovered that OpenSSL incorrectly handled certain X.509 Email

Addresses. If a certificate authority were tricked into signing a

specially-crafted certificate, a remote attacker could possibly use this

issue to cause OpenSSL to crash, resulting in a denial of service. The

default compiler options for affected releases reduce the vulnerability to

a denial of service. (CVE-2022-3602, CVE-2022-3786)

It was discovered that OpenSSL incorrectly handled applications creating

custom ciphers via the legacy EVP_CIPHER_meth_new() function. This issue

could cause certain applications that mishandled values to the function to

possibly end up with a NULL cipher and messages in plaintext.

(CVE-2022-3358)

Topics%20covered

Topics Covered

security advisory remote attack Ubuntu OpenSSL Denial of Service critical security update

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   libssl3                         3.0.5-2ubuntu2

Ubuntu 22.04 LTS:
   libssl3                         3.0.2-0ubuntu1.7

After a standard system update you need to reboot your computer to make all
the necessary changes.

References

https://ubuntu.com/security/notices/USN-5710-1

CVE-2022-3358, CVE-2022-3602, CVE-2022-3786

Severity
critical
Lowest
Low
Medium
High
Critical

November 01, 2022

Topics%20covered

Topics Covered

security advisory remote attack Ubuntu OpenSSL Denial of Service critical security update

Package Information

https://launchpad.net/ubuntu/+source/openssl/3.0.5-2ubuntu2
https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.7

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here