Ubuntu 21.10 USN-5328-1 Critical: OpenSSL Denial Of Service

ubuntu

March 15, 2022

OpenSSL could be made to stop responding if it opened a specially crafted certificate.

Summary

OpenSSL could be made to stop responding if it opened a specially crafted

certificate.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

- openssl1.0: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Tavis Ormandy discovered that OpenSSL incorrectly parsed certain

certificates. A remote attacker could possibly use this issue to cause

OpenSSH to stop responding, resulting in a denial of service.

Topics Covered

security advisory denial of service security issue Ubuntu OpenSSL system update openssl vulnerability

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  libssl1.1                       1.1.1l-1ubuntu1.2

Ubuntu 20.04 LTS:
  libssl1.1                       1.1.1f-1ubuntu2.12

Ubuntu 18.04 LTS:
  libssl1.0.0                     1.0.2n-1ubuntu5.8
  libssl1.1                       1.1.1-1ubuntu2.1~18.04.15

After a standard system update you need to reboot your computer to make
all the necessary changes.