USN-5844-1

Source
https://ubuntu.com/security/notices/USN-5844-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/USN-5844-1.json
Related
Published
2023-02-07T17:20:39.900112Z
Modified
2023-02-07T17:20:39.900112Z
Details

David Benjamin discovered that OpenSSL incorrectly handled X.400 address processing. A remote attacker could possibly use this issue to read arbitrary memory contents or cause OpenSSL to crash, resulting in a denial of service. (CVE-2023-0286)

Corey Bonnell discovered that OpenSSL incorrectly handled X.509 certificate verification. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-4203)

Hubert Kario discovered that OpenSSL had a timing based side channel in the OpenSSL RSA Decryption implementation. A remote attacker could possibly use this issue to recover sensitive information. (CVE-2022-4304)

Dawei Wang discovered that OpenSSL incorrectly handled parsing certain PEM data. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2022-4450)

Octavio Galland and Marcel Böhme discovered that OpenSSL incorrectly handled streaming ASN.1 data. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-0215)

Marc Schönefeld discovered that OpenSSL incorrectly handled malformed PKCS7 data. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2023-0216)

Kurt Roeckx discovered that OpenSSL incorrectly handled validating certain DSA public keys. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2023-0217)

Hubert Kario and Dmitry Belyavsky discovered that OpenSSL incorrectly validated certain signatures. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2023-0401)

References

Affected packages

Ubuntu:22.04:LTS / openssl

Package

Name
openssl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
3.0.2-0ubuntu1.8

Ecosystem specific 

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "libssl3": "3.0.2-0ubuntu1.8",
            "libssl-dev": "3.0.2-0ubuntu1.8",
            "openssl": "3.0.2-0ubuntu1.8",
            "libssl-doc": "3.0.2-0ubuntu1.8"
        }
    ]
}

Ubuntu:18.04:LTS / openssl

Package

Name
openssl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.1.1-1ubuntu2.1~18.04.21

Ecosystem specific 

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "libssl1.1": "1.1.1-1ubuntu2.1~18.04.21",
            "libssl-dev": "1.1.1-1ubuntu2.1~18.04.21",
            "openssl": "1.1.1-1ubuntu2.1~18.04.21",
            "libssl-doc": "1.1.1-1ubuntu2.1~18.04.21"
        }
    ]
}

Ubuntu:20.04:LTS / openssl

Package

Name
openssl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0The exact introduced commit is unknown
Fixed
1.1.1f-1ubuntu2.17

Ecosystem specific 

{
    "availability": "No subscription needed",
    "binaries": [
        {
            "libssl1.1": "1.1.1f-1ubuntu2.17",
            "libssl-dev": "1.1.1f-1ubuntu2.17",
            "openssl": "1.1.1f-1ubuntu2.17",
            "libssl-doc": "1.1.1f-1ubuntu2.17"
        }
    ]
}