Ubuntu 22.04 LTS: USN-5403-1 Major OpenSSL Vulnerabilities

ubuntu

May 4, 2022

Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

- openssl1.0: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Elison Niven discovered that OpenSSL incorrectly handled the c_rehash

script. A local attacker could possibly use this issue to execute arbitrary

commands when c_rehash is run. (CVE-2022-1292)

Raul Metsma discovered that OpenSSL incorrectly verified certain response

signing certificates. A remote attacker could possibly use this issue to

spoof certain response signing certificates. This issue only affected

Ubuntu 22.04 LTS. (CVE-2022-1343)

Tom Colley discovered that OpenSSL used the incorrect MAC key in the

RC4-MD5 ciphersuite. In non-default configurations were RC4-MD5 is enabled,

a remote attacker could possibly use this issue to modify encrypted

communications. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1434)

Aliaksei Levin d...

Read the Full Advisory

Topics Covered

security advisory critical issue update ubuntu openssl

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  libssl3                         3.0.2-0ubuntu1.1

Ubuntu 21.10:
  libssl1.1                       1.1.1l-1ubuntu1.3

Ubuntu 20.04 LTS:
  libssl1.1                       1.1.1f-1ubuntu2.13

Ubuntu 18.04 LTS:
  libssl1.0.0                     1.0.2n-1ubuntu5.9
  libssl1.1                       1.1.1-1ubuntu2.1~18.04.17

After a standard system update you need to reboot your computer to make
all the necessary changes.