Ubuntu 22.10 USN-5844-1 Critical: OpenSSL Attack Risks and Fixes

ubuntu

February 7, 2023

Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

David Benjamin discovered that OpenSSL incorrectly handled X.400 address

processing. A remote attacker could possibly use this issue to read

arbitrary memory contents or cause OpenSSL to crash, resulting in a denial

of service. (CVE-2023-0286)

Corey Bonnell discovered that OpenSSL incorrectly handled X.509 certificate

verification. A remote attacker could possibly use this issue to cause

OpenSSL to crash, resulting in a denial of service. This issue only

affected Ubuntu 22.04 LTS and Ubuntu 22.10. (CVE-2022-4203)

Hubert Kario discovered that OpenSSL had a timing based side channel in the

OpenSSL RSA Decryption implementation. A remote attacker could possibly use

this issue to recover sensitive information. (CVE-2022-4304)

Dawei Wang discovered that OpenSSL incorrectly handled parsing certain PEM

data. A remot...

Read the Full Advisory

Topics Covered

security advisory denial of service update remote attack Ubuntu OpenSSL vulnerability

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   libssl3                         3.0.5-2ubuntu2.1

Ubuntu 22.04 LTS:
   libssl3                         3.0.2-0ubuntu1.8

Ubuntu 20.04 LTS:
   libssl1.1                       1.1.1f-1ubuntu2.17

Ubuntu 18.04 LTS:
   libssl1.1                       1.1.1-1ubuntu2.1~18.04.21

After a standard system update you need to reboot your computer to make all
the necessary changes.