Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]
- Ubuntu Security Notice USN-5710-1[6]
- Authored by Ubuntu[7] | Site security.ubuntu.com[8]
-
Ubuntu Security Notice 5710-1 - It was discovered that OpenSSL incorrectly handled certain X.509 Email Addresses. If a certificate authority were tricked into signing a specially-crafted certificate, a remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. The default compiler options for affected releases reduce the vulnerability to a denial of service. It was discovered that OpenSSL incorrectly handled applications creating custom ciphers via the legacy EVP_CIPHER_meth_new function. This issue could cause certain applications that mishandled values to the function to possibly end up with a NULL cipher and messages in plaintext.
- systems | linux[9], ubuntu[10]
- advisories | CVE-2022-3358[11]
- SHA-256 |
7b62b4888702cab45aeeaeff8c5ec0500b30513d208729751998d56e5717a938
- Download[12] | Favorite[13] | View[14]
Change Mirror[15] Download[16]
==========================================================================
Ubuntu Security Notice USN-5710-1
November 01, 2022
openssl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.10
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in OpenSSL.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
It was discovered that OpenSSL incorrectly handled certain X.509 Email
Addresses. If a certificate authority were tricked into signing a
specially-crafted certificate, a remote attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. The
default compiler options for affected releases reduce the vulnerability to
a denial of service. (CVE-2022-3602, CVE-2022-3786)
It was discovered that OpenSSL incorrectly handled applications creating
custom ciphers via the legacy EVP_CIPHER_meth_new() function. This issue
could cause certain applications that mishandled values to the function to
possibly end up with a NULL cipher and messages in plaintext.
(CVE-2022-3358)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.10:
libssl3 3.0.5-2ubuntu2
Ubuntu 22.04 LTS:
libssl3 3.0.2-0ubuntu1.7
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5710-1
CVE-2022-3358, CVE-2022-3602, CVE-2022-3786
Package Information:
https://launchpad.net/ubuntu/+source/openssl/3.0.5-2ubuntu2
https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.7
File Tags
- ActiveX[21] (932)
- Advisory[22] (79,294)
- Arbitrary[23] (15,599)
- BBS[24] (2,859)
- Bypass[25] (1,609)
- CGI[26] (1,014)
- Code Execution[27] (6,860)
- Conference[28] (672)
- Cracker[29] (840)
- CSRF[30] (3,282)
- DoS[31] (22,450)
- Encryption[32] (2,346)
- Exploit[33] (50,232)
- File Inclusion[34] (4,161)
- File Upload[35] (945)
- Firewall[36] (821)
- Info Disclosure[37] (2,649)
- Intrusion Detection[38] (863)
- Java[39] (2,882)
- JavaScript[40] (814)
- Kernel[41] (6,224)
- Local[42] (14,152)
- Magazine[43] (586)
- Overflow[44] (12,342)
- Perl[45] (1,417)
- PHP[46] (5,076)
- Proof of Concept[47] (2,286)
- Protocol[48] (3,410)
- Python[49] (1,438)
- Remote[50] (29,964)
- Root[51] (3,490)
- Ruby[52] (594)
- Scanner[53] (1,631)
- Security Tool[54] (7,758)
- Shell[55] (3,096)
- Shellcode[56] (1,204)
- Sniffer[57] (885)
- Spoof[58] (2,160)
- SQL Injection[59] (16,079)
- TCP[60] (2,374)
- Trojan[61] (682)
- UDP[62] (874)
- Virus[63] (660)
- Vulnerability[64] (31,006)
- Web[65] (9,289)
- Whitepaper[66] (3,724)
- x86[67] (944)
- XSS[68] (17,461)
- Other[69]
File Archives
- November 2022[70]
- October 2022[71]
- September 2022[72]
- August 2022[73]
- July 2022[74]
- June 2022[75]
- May 2022[76]
- April 2022[77]
- March 2022[78]
- February 2022[79]
- January 2022[80]
- December 2021[81]
- Older[82]
Systems
- AIX[83] (426)
- Apple[84] (1,923)
- BSD[85] (369)
- CentOS[86] (55)
- Cisco[87] (1,916)
- Debian[88] (6,599)
- Fedora[89] (1,690)
- FreeBSD[90] (1,242)
- Gentoo[91] (4,261)
- HPUX[92] (878)
- iOS[93] (329)
- iPhone[94] (108)
- IRIX[95] (220)
- Juniper[96] (67)
- Linux[97] (43,860)
- Mac OS X[98] (684)
- Mandriva[99] (3,105)
- NetBSD[100] (255)
- OpenBSD[101] (479)
- RedHat[102] (12,159)
- Slackware[103] (941)
- Solaris[104] (1,607)
- SUSE[105] (1,444)
- Ubuntu[106] (8,102)
- UNIX[107] (9,138)
- UnixWare[108] (185)
- Windows[109] (6,491)
- Other[110]
Read more https://packetstormsecurity.com/files/169684/USN-5710-1.txt