Package "openssl1.0"
Name: |
openssl1.0
|
Description: |
This package is just an umbrella for a group of other packages,
it has no description. Description samples from packages in group:
- Secure Sockets Layer toolkit - development files
- Secure Sockets Layer toolkit - shared libraries
|
Latest version: |
1.0.2n-1ubuntu5.13 |
Release: |
bionic (18.04) |
Level: |
security |
Repository: |
main |
Links
Other versions of "openssl1.0" in Bionic
Packages in group
Deleted packages are displayed in grey.
Changelog
openssl1.0 (1.0.2n-1ubuntu5.8) bionic-security; urgency=medium
* SECURITY UPDATE: Infinite loop in BN_mod_sqrt()
- debian/patches/CVE-2022-0778.patch: fix infinite loop in
crypto/bn/bn_sqrt.c.
- CVE-2022-0778
-- Marc Deslauriers <email address hidden> Wed, 09 Mar 2022 07:36:36 -0500
|
Source diff to previous version |
CVE-2022-0778 |
Infinite loop in BN_mod_sqrt() reachable when parsing certificates |
|
openssl1.0 (1.0.2n-1ubuntu5.7) bionic-security; urgency=medium
* SECURITY UPDATE: Read buffer overrun in X509_aux_print()
- debian/patches/CVE-2021-3712.patch: fix a read buffer overrun in
X509_CERT_AUX_print() in crypto/asn1/t_x509a.c.
- debian/patches/CVE-2021-3712-2.patch: fix i2v_GENERAL_NAME to not
assume NUL terminated strings in crypto/x509v3/v3_alt.c,
crypto/x509v3/v3_utl.c, crypto/x509v3/x509v3.h.
- debian/patches/CVE-2021-3712-3.patch: fix POLICYINFO printing to not
assume NUL terminated strings in crypto/x509v3/v3_cpols.c.
- debian/patches/CVE-2021-3712-4.patch: fix printing of
PROXY_CERT_INFO_EXTENSION to not assume NUL terminated strings in
crypto/x509v3/v3_pci.c.
- debian/patches/CVE-2021-3712-5.patch: fix the name constraints code
to not assume NUL terminated strings in crypto/x509v3/v3_ncons.c.
- debian/patches/CVE-2021-3712-7.patch: fix append_ia5 function to not
assume NUL terminated strings in crypto/x509v3/v3_utl.c.
- debian/patches/CVE-2021-3712-8.patch: fix NETSCAPE_SPKI_print
function to not assume NUL terminated strings in
crypto/asn1/t_spki.c.
- debian/patches/CVE-2021-3712-9.patch: fix
EC_GROUP_new_from_ecparameters to check the base length in
crypto/ec/ec_asn1.c.
- debian/patches/CVE-2021-3712-11.patch: fix the error handling in
i2v_AUTHORITY_KEYID in crypto/x509v3/v3_akey.c.
- debian/patches/CVE-2021-3712-13.patch: fix the name constraints code
to not assume NUL terminated strings in crypto/x509v3/v3_ncons.c.
- debian/patches/CVE-2021-3712-14.patch: fix i2v_GENERAL_NAME to not
assume NUL terminated strings in crypto/x509v3/v3_utl.c.
- CVE-2021-3712
-- Marc Deslauriers <email address hidden> Tue, 24 Aug 2021 12:16:56 -0400
|
Source diff to previous version |
|
openssl1.0 (1.0.2n-1ubuntu5.6) bionic-security; urgency=medium
* SECURITY UPDATE: Integer overflow in CipherUpdate
- debian/patches/CVE-2021-23840-pre1.patch: add new EVP error codes in
crypto/evp/evp_err.c, crypto/evp/evp.h.
- debian/patches/CVE-2021-23840-pre2.patch: add a new EVP error code in
crypto/evp/evp_err.c, crypto/evp/evp.h.
- debian/patches/CVE-2021-23840.patch: don't overflow the output length
in EVP_CipherUpdate calls in crypto/evp/evp_enc.c,
crypto/evp/evp_err.c, crypto/evp/evp.h.
- CVE-2021-23840
* SECURITY UPDATE: Null pointer deref in X509_issuer_and_serial_hash()
- debian/patches/CVE-2021-23841.patch: fix Null pointer deref in
crypto/x509/x509_cmp.c.
- CVE-2021-23841
-- Marc Deslauriers <email address hidden> Wed, 17 Feb 2021 10:33:20 -0500
|
Source diff to previous version |
CVE-2021-23840 |
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is cl |
CVE-2021-23841 |
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is cl |
|
openssl1.0 (1.0.2n-1ubuntu5.5) bionic-security; urgency=medium
* SECURITY UPDATE: EDIPARTYNAME NULL pointer de-ref
- debian/patches/CVE-2020-1971-1.patch: use explicit tagging for
DirectoryString in crypto/x509v3/v3_genn.c.
- debian/patches/CVE-2020-1971-2.patch: correctly compare EdiPartyName
in crypto/x509v3/v3_genn.c.
- debian/patches/CVE-2020-1971-3.patch: check that multi-strings/CHOICE
types don't use implicit tagging in crypto/asn1/asn1_err.c,
crypto/asn1/tasn_dec.c, crypto/asn1/asn1.h.
- debian/patches/CVE-2020-1971-4.patch: complain if we are attempting
to encode with an invalid ASN.1 template in crypto/asn1/asn1_err.c,
crypto/asn1/tasn_enc.c, crypto/asn1/asn1.h.
- debian/patches/CVE-2020-1971-5.patch: add a test for GENERAL_NAME_cmp
in crypto/x509v3/v3nametest.c.
- CVE-2020-1971
-- Marc Deslauriers <email address hidden> Wed, 02 Dec 2020 14:54:00 -0500
|
Source diff to previous version |
|
openssl1.0 (1.0.2n-1ubuntu5.4) bionic-security; urgency=medium
* SECURITY UPDATE: Raccoon Attack
- debian/patches/CVE-2020-1968.patch: disable ciphers that reuse the
DH secret across multiple TLS connections in ssl/s3_lib.c.
- CVE-2020-1968
* SECURITY UPDATE: ECDSA remote timing attack
- debian/patches/CVE-2019-1547.patch: for ECC parameters with NULL or
zero cofactor, compute it in crypto/ec/ec.h, crypto/ec/ec_err.c,
crypto/ec/ec_lib.c.
- CVE-2019-1547
* SECURITY UPDATE: rsaz_512_sqr overflow bug on x86_64
- debian/patches/CVE-2019-1551.patch: fix an overflow bug in
rsaz_512_sqr in crypto/bn/asm/rsaz-x86_64.pl.
- CVE-2019-1551
* SECURITY UPDATE: Padding Oracle issue
- debian/patches/CVE-2019-1563.patch: fix a padding oracle in
PKCS7_dataDecode and CMS_decrypt_set1_pkey in crypto/cms/cms_env.c,
crypto/cms/cms_lcl.h, crypto/cms/cms_smime.c,
crypto/pkcs7/pk7_doit.c.
- CVE-2019-1563
-- Marc Deslauriers <email address hidden> Wed, 16 Sep 2020 07:51:13 -0400
|
CVE-2020-1968 |
The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections |
CVE-2019-1547 |
Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is po |
CVE-2019-1551 |
There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analy |
CVE-2019-1563 |
In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very l |
|
About
-
Send Feedback to @ubuntu_updates