USN-6119-1: OpenSSL vulnerabilities

Releases

• Ubuntu 23.04
• Ubuntu 22.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• openssl - Secure Socket Layer (SSL) cryptographic library and tools
• openssl1.0 - Secure Socket Layer (SSL) cryptographic library and tools

Details

Matt Caswell discovered that OpenSSL incorrectly handled certain ASN.1
object identifiers. A remote attacker could possibly use this issue to
cause OpenSSL to consume resources, resulting in a denial of service.
(CVE-2023-2650)

Anton Romanov discovered that OpenSSL incorrectly handled AES-XTS cipher
decryption on 64-bit ARM platforms. An attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. This
issue only affected Ubuntu 22.04 LTS, Ubuntu 22.10, and Ubuntu 23.04.
(CVE-2023-1255)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• libssl3 - 3.0.8-1ubuntu1.2

Ubuntu 22.10

• libssl3 - 3.0.5-2ubuntu2.3

Ubuntu 22.04

• libssl3 - 3.0.2-0ubuntu1.10

Ubuntu 20.04

• libssl1.1 - 1.1.1f-1ubuntu2.19

Ubuntu 18.04

• libssl1.0.0 - 1.0.2n-1ubuntu5.13
• libssl1.1 - 1.1.1-1ubuntu2.1~18.04.23

After a standard system update you need to reboot your computer to make all
the necessary changes.

References

• CVE-2023-1255
• CVE-2023-2650

Related notices

• USN-6188-1: libssl-doc, libssl-dev, openssl, libssl1.0.0
• USN-6672-1: nodejs, libnode-dev, libnode72, libnode108, libnode64, nodejs-doc