Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 494
Alerts This Week
Warning Icon 1 494

Ubuntu 20.04 OpenSSH Security Notification: Critical Risk Key Impersonation

fedora
Calendar Grey July 13, 2015
Scroller Fedora
This patch resolves critical CVE-2021-3456 in the Ubuntu 20.04's openssl component, targeting vulnerabilities related to encryption flaws.
Security fix for CVE-2015-1793 high severity issue.

Summary

The OpenSSL toolkit provides support for secure communications between

machines. OpenSSL includes a certificate management tool and shared

libraries which provide various cryptographic algorithms and

protocols.

Update Information:

Security fix for CVE-2015-1793 high severity issue.

Topics%20covered

Topics Covered

security advisory high severity security issue update Fedora openssl certificate forgery

Change Log

* Thu Jul 9 2015 Tomáš Mráz 1.0.1k-11 - fix CVE-2015-1793 - certificate verification forgery * Mon Jun 15 2015 Tomáš Mráz 1.0.1k-10 - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent - fix CVE-2015-1791 - race condition handling NewSessionTicket - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function - add missing parts of CVE-2015-0209 fix for corectness although unexploitable * Fri May 29 2015 Tomáš Mráz 1.0.1k-9 - fix CVE-2015-4000 - prevent the logjam attack on client - restrict the DH key size to at least 768 bits (limit will be increased in future) * Thu Apr 30 2015 Tomáš Mráz 1.0.1k-8 - try to find alternative cert chains (#1166614) * Thu Apr 9 2015 Tomáš Mráz 1.0.1k-7 - drop the AES-GCM restriction of 2^32 operations because the IV is always 96 bits (32 bit fixed field + 64 bit invocation field) * Thu Mar 19 2015 Tomáš Mráz 1.0.1k-6 - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey() - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data - fix CVE-2015-0293 - triggerable assert in SSLv2 server * Mon Mar 16 2015 Tomáš Mráz 1.0.1k-5 - fix bug in the CRYPTO_128_unwrap() * Fri Feb 27 2015 Tomáš Mráz 1.0.1k-4 - fix bug in the RFC 5649 support (#1185878) * Sat Feb 21 2015 Till Maas - 1:1.0.1k-3 - Rebuilt for Fedora 23 Change https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code * Thu Jan 15 2015 Tomáš Mráz 1.0.1k-2 - test in the non-FIPS RSA keygen for minimal distance of p and q similarly to the FIPS RSA keygen * Fri Jan 9 2015 Tomáš Mráz 1.0.1k-1 - new upstream release fixing multiple security issues * Tue Oct 21 2014 Tomáš Mráz 1.0.1j-2 - update the FIPS RSA keygen to be FIPS 186-4 compliant

References


[ 1 ] Bug #1238619 - CVE-2015-1793 openssl: alternative chains certificate forgery https://bugzilla.redhat.com/show_bug.cgi?id=1238619

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update openssl' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: openssl
Product: Fedora 21
Version: 1.0.1k
Release: 11.fc21
URL: https://www.openssl.org:443/
Summary: Utilities from the general purpose cryptography library with TLS implementation

Topics%20covered

Topics Covered

security advisory high severity security issue update Fedora openssl certificate forgery

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.