UbuntuUpdates.org

Package "openssl1.0"

Name: openssl1.0

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Secure Sockets Layer toolkit - development files
  • Secure Sockets Layer toolkit - shared libraries

Latest version: 1.0.2n-1ubuntu5.10
Release: bionic (18.04)
Level: updates
Repository: main

Links



Other versions of "openssl1.0" in Bionic

Repository Area Version
base universe 1.0.2n-1ubuntu5
security universe 1.0.2n-1ubuntu5.10
security main 1.0.2n-1ubuntu5.10
updates universe 1.0.2n-1ubuntu5.10

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.0.2n-1ubuntu5.10 2022-06-21 17:06:22 UTC

  openssl1.0 (1.0.2n-1ubuntu5.10) bionic-security; urgency=medium

  * SECURITY UPDATE: c_rehash script allows command injection
    - debian/patches/CVE-2022-1292.patch: switch to upstream patch, and
      apply it before c_rehash-compat.patch.
    - debian/patches/CVE-2022-2068.patch: fix file operations in
      tools/c_rehash.in.
    - debian/patches/c_rehash-compat.patch: updated patch to apply after
      the security updates.
    - CVE-2022-2068

 -- Marc Deslauriers <email address hidden> Mon, 20 Jun 2022 13:34:16 -0400

Source diff to previous version
CVE-2022-1292 The c_rehash script does not properly sanitise shell metacharacters to ...
CVE-2022-2068 The c_rehash script allows command injection

Version: 1.0.2n-1ubuntu5.9 2022-05-04 19:06:22 UTC

  openssl1.0 (1.0.2n-1ubuntu5.9) bionic-security; urgency=medium

  * SECURITY UPDATE: c_rehash script allows command injection
    - debian/patches/CVE-2022-1292.patch: do not use shell to invoke
      openssl in tools/c_rehash.in.
    - CVE-2022-1292

 -- Marc Deslauriers <email address hidden> Wed, 04 May 2022 07:54:44 -0400

Source diff to previous version
CVE-2022-1292 The c_rehash script does not properly sanitise shell metacharacters to ...

Version: 1.0.2n-1ubuntu5.8 2022-03-15 20:07:20 UTC

  openssl1.0 (1.0.2n-1ubuntu5.8) bionic-security; urgency=medium

  * SECURITY UPDATE: Infinite loop in BN_mod_sqrt()
    - debian/patches/CVE-2022-0778.patch: fix infinite loop in
      crypto/bn/bn_sqrt.c.
    - CVE-2022-0778

 -- Marc Deslauriers <email address hidden> Wed, 09 Mar 2022 07:36:36 -0500

Source diff to previous version
CVE-2022-0778 Infinite loop in BN_mod_sqrt() reachable when parsing certificates

Version: 1.0.2n-1ubuntu5.7 2021-08-26 15:06:20 UTC

  openssl1.0 (1.0.2n-1ubuntu5.7) bionic-security; urgency=medium

  * SECURITY UPDATE: Read buffer overrun in X509_aux_print()
    - debian/patches/CVE-2021-3712.patch: fix a read buffer overrun in
      X509_CERT_AUX_print() in crypto/asn1/t_x509a.c.
    - debian/patches/CVE-2021-3712-2.patch: fix i2v_GENERAL_NAME to not
      assume NUL terminated strings in crypto/x509v3/v3_alt.c,
      crypto/x509v3/v3_utl.c, crypto/x509v3/x509v3.h.
    - debian/patches/CVE-2021-3712-3.patch: fix POLICYINFO printing to not
      assume NUL terminated strings in crypto/x509v3/v3_cpols.c.
    - debian/patches/CVE-2021-3712-4.patch: fix printing of
      PROXY_CERT_INFO_EXTENSION to not assume NUL terminated strings in
      crypto/x509v3/v3_pci.c.
    - debian/patches/CVE-2021-3712-5.patch: fix the name constraints code
      to not assume NUL terminated strings in crypto/x509v3/v3_ncons.c.
    - debian/patches/CVE-2021-3712-7.patch: fix append_ia5 function to not
      assume NUL terminated strings in crypto/x509v3/v3_utl.c.
    - debian/patches/CVE-2021-3712-8.patch: fix NETSCAPE_SPKI_print
      function to not assume NUL terminated strings in
      crypto/asn1/t_spki.c.
    - debian/patches/CVE-2021-3712-9.patch: fix
      EC_GROUP_new_from_ecparameters to check the base length in
      crypto/ec/ec_asn1.c.
    - debian/patches/CVE-2021-3712-11.patch: fix the error handling in
      i2v_AUTHORITY_KEYID in crypto/x509v3/v3_akey.c.
    - debian/patches/CVE-2021-3712-13.patch: fix the name constraints code
      to not assume NUL terminated strings in crypto/x509v3/v3_ncons.c.
    - debian/patches/CVE-2021-3712-14.patch: fix i2v_GENERAL_NAME to not
      assume NUL terminated strings in crypto/x509v3/v3_utl.c.
    - CVE-2021-3712

 -- Marc Deslauriers <email address hidden> Tue, 24 Aug 2021 12:16:56 -0400

Source diff to previous version
CVE-2021-3712 Read buffer overruns processing ASN.1 strings

Version: 1.0.2n-1ubuntu5.6 2021-02-18 15:06:20 UTC

  openssl1.0 (1.0.2n-1ubuntu5.6) bionic-security; urgency=medium

  * SECURITY UPDATE: Integer overflow in CipherUpdate
    - debian/patches/CVE-2021-23840-pre1.patch: add new EVP error codes in
      crypto/evp/evp_err.c, crypto/evp/evp.h.
    - debian/patches/CVE-2021-23840-pre2.patch: add a new EVP error code in
      crypto/evp/evp_err.c, crypto/evp/evp.h.
    - debian/patches/CVE-2021-23840.patch: don't overflow the output length
      in EVP_CipherUpdate calls in crypto/evp/evp_enc.c,
      crypto/evp/evp_err.c, crypto/evp/evp.h.
    - CVE-2021-23840
  * SECURITY UPDATE: Null pointer deref in X509_issuer_and_serial_hash()
    - debian/patches/CVE-2021-23841.patch: fix Null pointer deref in
      crypto/x509/x509_cmp.c.
    - CVE-2021-23841

 -- Marc Deslauriers <email address hidden> Wed, 17 Feb 2021 10:33:20 -0500

CVE-2021-23840 Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is cl
CVE-2021-23841 Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is cl



About   -   Send Feedback to @ubuntu_updates