UBUNTU-CVE-2020-1968

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2020-1968

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2020/UBUNTU-CVE-2020-1968.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2020-1968

Related

Published

2020-09-09T00:00:00Z

Modified

2024-10-15T14:07:35Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).

References

Affected packages

Ubuntu:Pro:14.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl?arch=src?distro=trusty/esm

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.1f-1ubuntu2.27+esm10

Affected versions

1.*

1.0.1e-3ubuntu1

1.0.1e-4ubuntu1

1.0.1e-4ubuntu2

1.0.1e-4ubuntu3

1.0.1e-4ubuntu4

1.0.1f-1ubuntu1

1.0.1f-1ubuntu2

1.0.1f-1ubuntu2.1

1.0.1f-1ubuntu2.2

1.0.1f-1ubuntu2.3

1.0.1f-1ubuntu2.4

1.0.1f-1ubuntu2.5

1.0.1f-1ubuntu2.7

1.0.1f-1ubuntu2.8

1.0.1f-1ubuntu2.11

1.0.1f-1ubuntu2.12

1.0.1f-1ubuntu2.15

1.0.1f-1ubuntu2.16

1.0.1f-1ubuntu2.17

1.0.1f-1ubuntu2.18

1.0.1f-1ubuntu2.19

1.0.1f-1ubuntu2.20

1.0.1f-1ubuntu2.21

1.0.1f-1ubuntu2.22

1.0.1f-1ubuntu2.23

1.0.1f-1ubuntu2.24

1.0.1f-1ubuntu2.25

1.0.1f-1ubuntu2.26

1.0.1f-1ubuntu2.27

1.0.1f-1ubuntu2.27+esm1

1.0.1f-1ubuntu2.27+esm2

1.0.1f-1ubuntu2.27+esm3

1.0.1f-1ubuntu2.27+esm4

1.0.1f-1ubuntu2.27+esm5

1.0.1f-1ubuntu2.27+esm6

1.0.1f-1ubuntu2.27+esm7

1.0.1f-1ubuntu2.27+esm9

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libcrypto1.0.0-udeb"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libcrypto1.0.0-udeb-dbgsym"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libssl-dev"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libssl-dev-dbgsym"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libssl-doc"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libssl1.0.0"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libssl1.0.0-dbg"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libssl1.0.0-dbgsym"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libssl1.0.0-udeb"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "libssl1.0.0-udeb-dbgsym"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "openssl"
        },
        {
            "binary_version": "1.0.1f-1ubuntu2.27+esm10",
            "binary_name": "openssl-dbgsym"
        }
    ]
}

Ubuntu:16.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.2g-1ubuntu4.17

Affected versions

1.*

1.0.2d-0ubuntu1

1.0.2d-0ubuntu2

1.0.2e-1ubuntu1

1.0.2f-2ubuntu1

1.0.2g-1ubuntu2

1.0.2g-1ubuntu3

1.0.2g-1ubuntu4

1.0.2g-1ubuntu4.1

1.0.2g-1ubuntu4.2

1.0.2g-1ubuntu4.4

1.0.2g-1ubuntu4.5

1.0.2g-1ubuntu4.6

1.0.2g-1ubuntu4.8

1.0.2g-1ubuntu4.9

1.0.2g-1ubuntu4.10

1.0.2g-1ubuntu4.11

1.0.2g-1ubuntu4.12

1.0.2g-1ubuntu4.13

1.0.2g-1ubuntu4.14

1.0.2g-1ubuntu4.15

1.0.2g-1ubuntu4.16

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libcrypto1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libcrypto1.0.0-udeb-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libssl-dev"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libssl-dev-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libssl-doc"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libssl1.0.0"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libssl1.0.0-dbg"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libssl1.0.0-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libssl1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "libssl1.0.0-udeb-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "openssl"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.17",
            "binary_name": "openssl-dbgsym"
        }
    ]
}

Ubuntu:Pro:16.04:LTS / edk2

Package

Name: edk2
Purl: pkg:deb/ubuntu/edk2?arch=src?distro=esm-apps/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0~20150106.*

0~20150106.5c2d456b-2

0~20160104.*

0~20160104.c2a892d7-1

0~20160408.*

0~20160408.ffea0a2c-2

0~20160408.ffea0a2c-2ubuntu0.1

0~20160408.ffea0a2c-2ubuntu0.2

0~20160408.ffea0a2c-2ubuntu0.2+esm1

0~20160408.ffea0a2c-2ubuntu0.2+esm3

Ecosystem specific

{
    "ubuntu_priority": "low"
}

Ubuntu:Pro:FIPS:16.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl?arch=src?distro=fips-updates/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.2g-1ubuntu4.fips.4.17.1

Affected versions

1.*

1.0.2g-1ubuntu4.fips.4.9.1

1.0.2g-1ubuntu4.fips.4.13.1

1.0.2g-1ubuntu4.fips.4.15.1

1.0.2g-1ubuntu4.fips.4.16.1

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libcrypto1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libcrypto1.0.0-udeb-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl-dev"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl-dev-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl-doc"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl1.0.0"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl1.0.0-dbg"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl1.0.0-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl1.0.0-hmac"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl1.0.0-hmac-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "libssl1.0.0-udeb-dbgsym"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "openssl"
        },
        {
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1",
            "binary_name": "openssl-dbgsym"
        }
    ]
}

Ubuntu:Pro:FIPS:16.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl?arch=src?distro=fips/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.2g-1ubuntu4.fips.4.6~ppa1

1.0.2g-1ubuntu4.fips.4.6~ppa2

1.0.2g-1ubuntu4.fips.4.6~ppa3

1.0.2g-1ubuntu4.fips.4.6

1.0.2g-1ubuntu4.fips.4.6.1

1.0.2g-1ubuntu4.fips.4.6.2

1.0.2g-1ubuntu4.fips.4.6.3

Ecosystem specific

{
    "ubuntu_priority": "low"
}

Ubuntu:18.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1-1ubuntu2.1~18.04.6

Affected versions

1.*

1.0.2g-1ubuntu13

1.0.2g-1ubuntu14

1.0.2n-1ubuntu1

1.1.0g-2ubuntu1

1.1.0g-2ubuntu2

1.1.0g-2ubuntu3

1.1.0g-2ubuntu4

1.1.0g-2ubuntu4.1

1.1.0g-2ubuntu4.3

1.1.1-1ubuntu2.1~18.04.1

1.1.1-1ubuntu2.1~18.04.2

1.1.1-1ubuntu2.1~18.04.3

1.1.1-1ubuntu2.1~18.04.4

1.1.1-1ubuntu2.1~18.04.5

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libcrypto1.1-udeb"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl-dev"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl-doc"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl1.1"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl1.1-dbgsym"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "libssl1.1-udeb"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "openssl"
        },
        {
            "binary_version": "1.1.1-1ubuntu2.1~18.04.6",
            "binary_name": "openssl-dbgsym"
        }
    ]
}

Ubuntu:18.04:LTS / openssl1.0

Package

Name: openssl1.0
Purl: pkg:deb/ubuntu/openssl1.0?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.0.2n-1ubuntu5.4

Affected versions

1.*

1.0.2n-1ubuntu2

1.0.2n-1ubuntu3

1.0.2n-1ubuntu4

1.0.2n-1ubuntu5

1.0.2n-1ubuntu5.1

1.0.2n-1ubuntu5.2

1.0.2n-1ubuntu5.3

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libcrypto1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libssl1.0-dev"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libssl1.0.0"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libssl1.0.0-dbgsym"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "libssl1.0.0-udeb"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "openssl1.0"
        },
        {
            "binary_version": "1.0.2n-1ubuntu5.4",
            "binary_name": "openssl1.0-dbgsym"
        }
    ]
}

Ubuntu:20.04:LTS / openssl

Package

Name: openssl
Purl: pkg:deb/ubuntu/openssl?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1f-1ubuntu2

Affected versions

1.*

1.1.1c-1ubuntu4

1.1.1d-2ubuntu3

1.1.1d-2ubuntu6

1.1.1f-1ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.1.1f-1ubuntu2",
            "binary_name": "libcrypto1.1-udeb"
        },
        {
            "binary_version": "1.1.1f-1ubuntu2",
            "binary_name": "libssl-dev"
        },
        {
            "binary_version": "1.1.1f-1ubuntu2",
            "binary_name": "libssl-doc"
        },
        {
            "binary_version": "1.1.1f-1ubuntu2",
            "binary_name": "libssl1.1"
        },
        {
            "binary_version": "1.1.1f-1ubuntu2",
            "binary_name": "libssl1.1-dbgsym"
        },
        {
            "binary_version": "1.1.1f-1ubuntu2",
            "binary_name": "libssl1.1-udeb"
        },
        {
            "binary_version": "1.1.1f-1ubuntu2",
            "binary_name": "openssl"
        },
        {
            "binary_version": "1.1.1f-1ubuntu2",
            "binary_name": "openssl-dbgsym"
        }
    ]
}