ArchLinux: 201906-6: lib32-openssl: information disclosure

    Date13 Jun 2019
    Posted ByLinuxSecurity Advisories
    The package lib32-openssl before version 1:1.1.1.c-1 is vulnerable to information disclosure.
    Arch Linux Security Advisory ASA-201906-6
    Severity: Low
    Date    : 2019-06-11
    CVE-ID  : CVE-2019-1543
    Package : lib32-openssl
    Type    : information disclosure
    Remote  : Yes
    Link    :
    The package lib32-openssl before version 1:1.1.1.c-1 is vulnerable to
    information disclosure.
    Upgrade to 1:1.1.1.c-1.
    # pacman -Syu "lib32-openssl>=1:1.1.1.c-1"
    The problem has been fixed upstream in version 1.1.1.c.
    An issue has been found in OpenSSL <= 1.1.1b, where an application
    using ChaCha20-Poly1305 could set a non-default nonce length to be
    longer than 12 bytes and then mistakenly reuse a nonce.
    ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input
    for every encryption operation. RFC 7539 specifies that the nonce value
    (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce
    length and front pads the nonce with 0 bytes if it is less than 12
    bytes. However it also incorrectly allows a nonce to be set of up to 16
    bytes. In this case only the last 12 bytes are significant and any
    additional leading bytes are ignored.
    A remote attacker could disclose sensitive information via an invalid

    LinuxSecurity Poll

    What do you think of the LinuxSecurity Privacy news articles?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    [{"id":"90","title":"Love them!","votes":"90","type":"x","order":"1","pct":78.95,"resources":[]},{"id":"91","title":"I'm indifferent","votes":"18","type":"x","order":"2","pct":15.79,"resources":[]},{"id":"92","title":"Not interested in this topic","votes":"6","type":"x","order":"3","pct":5.26,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.