UbuntuUpdates.org

Package "openssl1.0"

Name: openssl1.0

Description:

Secure Sockets Layer toolkit 1.0 - cryptographic utility
Latest version: 1.0.2n-1ubuntu5.11
Release: bionic (18.04)
Level: security
Repository: universe
Homepage: https://www.openssl.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "openssl1.0"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "openssl1.0" in Bionic

Repository Area Version
base universe 1.0.2n-1ubuntu5
security main 1.0.2n-1ubuntu5.11
updates universe 1.0.2n-1ubuntu5.11
updates main 1.0.2n-1ubuntu5.11

Changelog

Version: 1.0.2n-1ubuntu5.11 2023-02-07 19:07:01 UTC

  openssl1.0 (1.0.2n-1ubuntu5.11) bionic-security; urgency=medium

  * SECURITY UPDATE: Use-after-free following BIO_new_NDEF
    - debian/patches/CVE-2023-0215.patch: fix a UAF resulting from a bug in
      BIO_new_NDEF in crypto/asn1/bio_ndef.c.
    - CVE-2023-0215
  * SECURITY UPDATE: X.400 address type confusion in X.509 GeneralName
    - debian/patches/CVE-2023-0286.patch: fix GENERAL_NAME_cmp for
      x400Address in crypto/x509/v3_genn.c, crypto/x509v3/x509v3.h.
    - CVE-2023-0286

 -- Marc Deslauriers <email address hidden> Mon, 06 Feb 2023 12:57:17 -0500
Source diff to previous version
CVE-2023-0215 openssl: Use-after-free following BIO_new_NDEF
CVE-2023-0286 openssl: X.400 address type confusion in X.509 GeneralName

Version: 1.0.2n-1ubuntu5.10 2022-06-21 15:06:20 UTC

  openssl1.0 (1.0.2n-1ubuntu5.10) bionic-security; urgency=medium

  * SECURITY UPDATE: c_rehash script allows command injection
    - debian/patches/CVE-2022-1292.patch: switch to upstream patch, and
      apply it before c_rehash-compat.patch.
    - debian/patches/CVE-2022-2068.patch: fix file operations in
      tools/c_rehash.in.
    - debian/patches/c_rehash-compat.patch: updated patch to apply after
      the security updates.
    - CVE-2022-2068

 -- Marc Deslauriers <email address hidden> Mon, 20 Jun 2022 13:34:16 -0400
Source diff to previous version
CVE-2022-1292 The c_rehash script does not properly sanitise shell metacharacters to ...
CVE-2022-2068 The c_rehash script allows command injection

Version: 1.0.2n-1ubuntu5.9 2022-05-04 17:06:19 UTC

  openssl1.0 (1.0.2n-1ubuntu5.9) bionic-security; urgency=medium

  * SECURITY UPDATE: c_rehash script allows command injection
    - debian/patches/CVE-2022-1292.patch: do not use shell to invoke
      openssl in tools/c_rehash.in.
    - CVE-2022-1292

 -- Marc Deslauriers <email address hidden> Wed, 04 May 2022 07:54:44 -0400
Source diff to previous version
CVE-2022-1292 The c_rehash script does not properly sanitise shell metacharacters to ...

Version: 1.0.2n-1ubuntu5.8 2022-03-15 18:06:59 UTC

  openssl1.0 (1.0.2n-1ubuntu5.8) bionic-security; urgency=medium

  * SECURITY UPDATE: Infinite loop in BN_mod_sqrt()
    - debian/patches/CVE-2022-0778.patch: fix infinite loop in
      crypto/bn/bn_sqrt.c.
    - CVE-2022-0778

 -- Marc Deslauriers <email address hidden> Wed, 09 Mar 2022 07:36:36 -0500
Source diff to previous version
CVE-2022-0778 Infinite loop in BN_mod_sqrt() reachable when parsing certificates

Version: 1.0.2n-1ubuntu5.7 2021-08-26 14:06:23 UTC

  openssl1.0 (1.0.2n-1ubuntu5.7) bionic-security; urgency=medium

  * SECURITY UPDATE: Read buffer overrun in X509_aux_print()
    - debian/patches/CVE-2021-3712.patch: fix a read buffer overrun in
      X509_CERT_AUX_print() in crypto/asn1/t_x509a.c.
    - debian/patches/CVE-2021-3712-2.patch: fix i2v_GENERAL_NAME to not
      assume NUL terminated strings in crypto/x509v3/v3_alt.c,
      crypto/x509v3/v3_utl.c, crypto/x509v3/x509v3.h.
    - debian/patches/CVE-2021-3712-3.patch: fix POLICYINFO printing to not
      assume NUL terminated strings in crypto/x509v3/v3_cpols.c.
    - debian/patches/CVE-2021-3712-4.patch: fix printing of
      PROXY_CERT_INFO_EXTENSION to not assume NUL terminated strings in
      crypto/x509v3/v3_pci.c.
    - debian/patches/CVE-2021-3712-5.patch: fix the name constraints code
      to not assume NUL terminated strings in crypto/x509v3/v3_ncons.c.
    - debian/patches/CVE-2021-3712-7.patch: fix append_ia5 function to not
      assume NUL terminated strings in crypto/x509v3/v3_utl.c.
    - debian/patches/CVE-2021-3712-8.patch: fix NETSCAPE_SPKI_print
      function to not assume NUL terminated strings in
      crypto/asn1/t_spki.c.
    - debian/patches/CVE-2021-3712-9.patch: fix
      EC_GROUP_new_from_ecparameters to check the base length in
      crypto/ec/ec_asn1.c.
    - debian/patches/CVE-2021-3712-11.patch: fix the error handling in
      i2v_AUTHORITY_KEYID in crypto/x509v3/v3_akey.c.
    - debian/patches/CVE-2021-3712-13.patch: fix the name constraints code
      to not assume NUL terminated strings in crypto/x509v3/v3_ncons.c.
    - debian/patches/CVE-2021-3712-14.patch: fix i2v_GENERAL_NAME to not
      assume NUL terminated strings in crypto/x509v3/v3_utl.c.
    - CVE-2021-3712

 -- Marc Deslauriers <email address hidden> Tue, 24 Aug 2021 12:16:56 -0400
CVE-2021-3712 Read buffer overruns processing ASN.1 strings


About   -   Send Feedback to @ubuntu_updates