UBUNTU-CVE-2019-1551

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2019-1551

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-1551.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-1551

Related

Published

2019-12-06T18:15:00Z

Modified

2019-12-06T18:15:00Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BNmodexp may be affected if they use BNFLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

References

Affected packages

Ubuntu:16.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.2g-1ubuntu4.16

Affected versions

1.*

1.0.2d-0ubuntu1

1.0.2d-0ubuntu2

1.0.2e-1ubuntu1

1.0.2f-2ubuntu1

1.0.2g-1ubuntu2

1.0.2g-1ubuntu3

1.0.2g-1ubuntu4

1.0.2g-1ubuntu4.1

1.0.2g-1ubuntu4.2

1.0.2g-1ubuntu4.4

1.0.2g-1ubuntu4.5

1.0.2g-1ubuntu4.6

1.0.2g-1ubuntu4.8

1.0.2g-1ubuntu4.9

1.0.2g-1ubuntu4.10

1.0.2g-1ubuntu4.11

1.0.2g-1ubuntu4.12

1.0.2g-1ubuntu4.13

1.0.2g-1ubuntu4.14

1.0.2g-1ubuntu4.15

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libcrypto1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libcrypto1.0.0-udeb-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libssl-dev"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libssl-dev-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libssl-doc"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libssl1.0.0"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libssl1.0.0-dbg"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libssl1.0.0-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libssl1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "libssl1.0.0-udeb-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "openssl"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.16",
            "binary_name": "openssl-dbgsym"
        }
    ]
}

Ubuntu:18.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1-1ubuntu2.1~18.04.6

Affected versions

1.*

1.0.2g-1ubuntu13

1.0.2g-1ubuntu14

1.0.2n-1ubuntu1

1.1.0g-2ubuntu1

1.1.0g-2ubuntu2

1.1.0g-2ubuntu3

1.1.0g-2ubuntu4

1.1.0g-2ubuntu4.1

1.1.0g-2ubuntu4.3

1.1.1-1ubuntu2.1~18.04.1

1.1.1-1ubuntu2.1~18.04.2

1.1.1-1ubuntu2.1~18.04.3

1.1.1-1ubuntu2.1~18.04.4

1.1.1-1ubuntu2.1~18.04.5

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libcrypto1.1-udeb"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl-dev"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl-doc"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl1.1"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl1.1-dbgsym"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl1.1-udeb"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "openssl"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "openssl-dbgsym"
        }
    ]
}

Ubuntu:18.04:LTS / openssl1.0

Package

Name: openssl1.0
Purl: pkg:deb/ubuntu/openssl1.0?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.2n-1ubuntu5.4

Affected versions

1.*

1.0.2n-1ubuntu2

1.0.2n-1ubuntu3

1.0.2n-1ubuntu4

1.0.2n-1ubuntu5

1.0.2n-1ubuntu5.1

1.0.2n-1ubuntu5.2

1.0.2n-1ubuntu5.3

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libcrypto1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libssl1.0-dev"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libssl1.0.0"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libssl1.0.0-dbgsym"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libssl1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "openssl1.0"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "openssl1.0-dbgsym"
        }
    ]
}

Ubuntu:20.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1f-1ubuntu1

Affected versions

1.*

1.1.1c-1ubuntu4

1.1.1d-2ubuntu3

1.1.1d-2ubuntu6

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.1.1f-1ubuntu1",
            "binary_name": "libcrypto1.1-udeb"
        },
        {
            "binary_version": "1.1.1f-1ubuntu1",
            "binary_name": "libssl-dev"
        },
        {
            "binary_version": "1.1.1f-1ubuntu1",
            "binary_name": "libssl-doc"
        },
        {
            "binary_version": "1.1.1f-1ubuntu1",
            "binary_name": "libssl1.1"
        },
        {
            "binary_version": "1.1.1f-1ubuntu1",
            "binary_name": "libssl1.1-dbgsym"
        },
        {
            "binary_version": "1.1.1f-1ubuntu1",
            "binary_name": "libssl1.1-udeb"
        },
        {
            "binary_version": "1.1.1f-1ubuntu1",
            "binary_name": "openssl"
        },
        {
            "binary_version": "1.1.1f-1ubuntu1",
            "binary_name": "openssl-dbgsym"
        }
    ]
}