UbuntuUpdates.org

Package "libssl1.1"

Name: libssl1.1

Description:

Secure Sockets Layer toolkit - shared libraries

Latest version: 1.1.1-1ubuntu2.1~18.04.4
Release: bionic (18.04)
Level: security
Repository: main
Head package: openssl
Homepage: https://www.openssl.org/

Links

Save this URL for the latest version of "libssl1.1": https://www.ubuntuupdates.org/libssl1.1


Download "libssl1.1"


Other versions of "libssl1.1" in Bionic

Repository Area Version
base main 1.1.0g-2ubuntu4
updates main 1.1.1-1ubuntu2.1~18.04.4

Changelog

Version: 1.1.1-1ubuntu2.1~18.04.4 2019-08-20 13:07:09 UTC

  openssl (1.1.1-1ubuntu2.1~18.04.4) bionic; urgency=medium

  * Import libraries/restart-without-asking as used in postinst, to
    prevent failure to configure the package without debconf database.
    LP: #1832919

 -- Dimitri John Ledkov <email address hidden> Thu, 20 Jun 2019 18:36:28 +0100

Source diff to previous version
1832919 installed libssl1.1:amd64 package post-installation script subprocess returned error exit status 10

Version: 1.1.0g-2ubuntu4.3 2018-12-06 19:07:04 UTC

  openssl (1.1.0g-2ubuntu4.3) bionic-security; urgency=medium

  * SECURITY UPDATE: PortSmash side channel attack
    - debian/patches/CVE-2018-5407-*.patch: add large number of upstream
      commits to resolve this issue.
    - CVE-2018-5407
  * SECURITY UPDATE: timing side channel attack in DSA
    - debian/patches/CVE-2018-0734-1.patch: fix mod inverse in
      crypto/dsa/dsa_ossl.c.
    - debian/patches/CVE-2018-0734-2.patch: fix timing vulnerability in
      crypto/dsa/dsa_ossl.c.
    - debian/patches/CVE-2018-0734-3.patch: add a constant time flag in
      crypto/dsa/dsa_ossl.c.
    - CVE-2018-0734
  * SECURITY UPDATE: timing side channel attack in ECDSA
    - debian/patches/CVE-2018-0735-1.patch: fix timing vulberability in
      crypto/ec/ec_mult.c.
    - debian/patches/CVE-2018-0735-2.patch: remove brace from bad
      cherry-pick in crypto/ec/ec_mult.c.
    - CVE-2018-0735

 -- Marc Deslauriers <email address hidden> Wed, 05 Dec 2018 10:59:52 -0500

Source diff to previous version
CVE-2018-5407 Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing at
CVE-2018-0734 The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing
CVE-2018-0735 The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signin

Version: 1.1.0g-2ubuntu4.1 2018-06-26 13:07:16 UTC

  openssl (1.1.0g-2ubuntu4.1) bionic-security; urgency=medium

  * SECURITY UPDATE: ECDSA key extraction side channel
    - debian/patches/CVE-2018-0495.patch: add blinding to an ECDSA
      signature in crypto/ec/ecdsa_ossl.c.
    - CVE-2018-0495
  * SECURITY UPDATE: denial of service via long prime values
    - debian/patches/CVE-2018-0732.patch: reject excessively large primes
      in DH key generation in crypto/dh/dh_key.c.
    - CVE-2018-0732
  * SECURITY UPDATE: RSA cache timing side channel attack
    - debian/patches/CVE-2018-0737-1.patch: replaced variable-time GCD in
      crypto/rsa/rsa_gen.c.
    - debian/patches/CVE-2018-0737-2.patch: used ERR set/pop mark in
      crypto/rsa/rsa_gen.c.
    - debian/patches/CVE-2018-0737-3.patch: consttime flag changed in
      crypto/rsa/rsa_gen.c.
    - debian/patches/CVE-2018-0737-4.patch: ensure BN_mod_inverse and
      BN_mod_exp_mont both get called with BN_FLG_CONSTTIME flag set in
      crypto/rsa/rsa_gen.c.
    - CVE-2018-0737

 -- Marc Deslauriers <email address hidden> Wed, 20 Jun 2018 07:29:12 -0400

CVE-2018-0495 Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of
CVE-2018-0732 During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will
CVE-2018-0737 The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack. An attacker with sufficient access to



About   -   Send Feedback to @ubuntu_updates