ArchLinux: 201906-6: lib32-openssl: information disclosure

    Date13 Jun 2019
    CategoryArchLinux
    285
    Posted ByLinuxSecurity Advisories
    The package lib32-openssl before version 1:1.1.1.c-1 is vulnerable to information disclosure.
    Arch Linux Security Advisory ASA-201906-6
    =========================================
    
    Severity: Low
    Date    : 2019-06-11
    CVE-ID  : CVE-2019-1543
    Package : lib32-openssl
    Type    : information disclosure
    Remote  : Yes
    Link    : https://security.archlinux.org/AVG-920
    
    Summary
    =======
    
    The package lib32-openssl before version 1:1.1.1.c-1 is vulnerable to
    information disclosure.
    
    Resolution
    ==========
    
    Upgrade to 1:1.1.1.c-1.
    
    # pacman -Syu "lib32-openssl>=1:1.1.1.c-1"
    
    The problem has been fixed upstream in version 1.1.1.c.
    
    Workaround
    ==========
    
    None.
    
    Description
    ===========
    
    An issue has been found in OpenSSL <= 1.1.1b, where an application
    using ChaCha20-Poly1305 could set a non-default nonce length to be
    longer than 12 bytes and then mistakenly reuse a nonce.
    ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input
    for every encryption operation. RFC 7539 specifies that the nonce value
    (IV) should be 96 bits (12 bytes). OpenSSL allows a variable nonce
    length and front pads the nonce with 0 bytes if it is less than 12
    bytes. However it also incorrectly allows a nonce to be set of up to 16
    bytes. In this case only the last 12 bytes are significant and any
    additional leading bytes are ignored.
    
    Impact
    ======
    
    A remote attacker could disclose sensitive information via an invalid
    nonce.
    
    References
    ==========
    
    https://www.openssl.org/news/secadv/20190306.txt
    https://github.com/openssl/openssl/commit/f426625b6a
    https://security.archlinux.org/CVE-2019-1543
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"5","type":"x","order":"1","pct":55.56,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":33.33,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":11.11,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.