UbuntuUpdates.org

Package "openssl"

Name: openssl

Description:

Secure Sockets Layer toolkit - cryptographic utility

Latest version: 1.1.1-1ubuntu2.1~18.04.6
Release: bionic (18.04)
Level: updates
Repository: main
Homepage: https://www.openssl.org/

Links


Download "openssl"


Other versions of "openssl" in Bionic

Repository Area Version
base main 1.1.0g-2ubuntu4
security main 1.1.1-1ubuntu2.1~18.04.6

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.1.1-1ubuntu2.1~18.04.6 2020-05-28 14:07:57 UTC

  openssl (1.1.1-1ubuntu2.1~18.04.6) bionic-security; urgency=medium

  * SECURITY UPDATE: ECDSA remote timing attack
    - debian/patches/CVE-2019-1547.patch: for ECC parameters with NULL or
      zero cofactor, compute it in crypto/ec/ec_lib.c.
    - CVE-2019-1547
  * SECURITY UPDATE: Fork Protection
    - debian/patches/CVE-2019-1549.patch: ensure fork-safety without using
      a pthread_atfork handler in crypto/include/internal/rand_int.h,
      crypto/init.c, crypto/rand/drbg_lib.c, crypto/rand/rand_lcl.h,
      crypto/rand/rand_lib.c, crypto/threads_none.c,
      crypto/threads_pthread.c, crypto/threads_win.c,
      include/internal/cryptlib.h, test/drbgtest.c.
    - CVE-2019-1549
  * SECURITY UPDATE: rsaz_512_sqr overflow bug on x86_64
    - debian/patches/CVE-2019-1551.patch: fix an overflow bug in
      rsaz_512_sqr in crypto/bn/asm/rsaz-x86_64.pl.
    - CVE-2019-1551
  * SECURITY UPDATE: Padding Oracle issue
    - debian/patches/CVE-2019-1563.patch: fix a padding oracle in
      PKCS7_dataDecode and CMS_decrypt_set1_pkey in crypto/cms/cms_env.c,
      crypto/cms/cms_lcl.h, crypto/cms/cms_smime.c,
      crypto/pkcs7/pk7_doit.c.
    - CVE-2019-1563

 -- Marc Deslauriers <email address hidden> Wed, 27 May 2020 15:15:54 -0400

Source diff to previous version
CVE-2019-1547 Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is po
CVE-2019-1549 OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in o
CVE-2019-1551 There is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analy
CVE-2019-1563 In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very l

Version: 1.1.1-1ubuntu2.1~18.04.5 2019-11-18 15:06:48 UTC

  openssl (1.1.1-1ubuntu2.1~18.04.5) bionic-security; urgency=medium

  * debian/patches/OPENSSL_malloc_init_hang.patch: make
    OPENSSL_malloc_init() a no-op to remove a potential infinite loop that
    can occur in some situations, such as with MySQL 5.7 on s390x.

 -- Marc Deslauriers <email address hidden> Tue, 12 Nov 2019 11:58:35 -0500

Source diff to previous version

Version: 1.1.1-1ubuntu2.1~18.04.4 2019-07-15 17:07:04 UTC

  openssl (1.1.1-1ubuntu2.1~18.04.4) bionic; urgency=medium

  * Import libraries/restart-without-asking as used in postinst, to
    prevent failure to configure the package without debconf database.
    LP: #1832919

 -- Dimitri John Ledkov <email address hidden> Thu, 20 Jun 2019 18:36:28 +0100

Source diff to previous version
1832919 installed libssl1.1:amd64 package post-installation script subprocess returned error exit status 10

Version: 1.1.1-1ubuntu2.1~18.04.3 2019-06-20 20:07:17 UTC

  openssl (1.1.1-1ubuntu2.1~18.04.3) bionic; urgency=medium

  * Fix path to Xorg for reboot notifications on desktop. LP: #1832421
  * Cherrypick upstream fix to allow succesful init of libssl and
    libcrypto using separate calls with different options. LP: #1832659

 -- Dimitri John Ledkov <email address hidden> Fri, 14 Jun 2019 13:50:28 +0100

Source diff to previous version
1832421 openssl reboot needed message using incorrect path to X server
1832659 openssl 1.1.1-1ubuntu2.1~18.04.1 contains upstream bug 7350

Version: 1.1.1-1ubuntu2.1~18.04.2 2019-06-14 03:06:55 UTC

  openssl (1.1.1-1ubuntu2.1~18.04.2) bionic; urgency=medium

  * Cherrypick upstream patch to fix ca -spkac output to be text again.
    LP: #1828215
  * Cherrypick upstream patch to prevent over long nonces in ChaCha20-Poly1305
    CVE-2019-1543
  * Bump major version of OpenSSL in postinst to trigger services restart
    upon upgrade. Many services listed there must be restarted when
    upgrading 1.1.0 to 1.1.1. LP: #1832522

 -- Dimitri John Ledkov <email address hidden> Wed, 12 Jun 2019 00:12:47 +0100

1828215 openssl ca -spkac output regressed
1832522 openssl maintainer scripts do not trigger services restart
CVE-2019-1543 ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for every encryption operation. RFC 7539 specifies that the nonce value (IV) s



About   -   Send Feedback to @ubuntu_updates