Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Ubuntu 24.04 LTS USN-6663-3 Moderate: OpenSSL PKCS#1 Timing Risk

ubuntu
Calendar Grey May 23, 2024
Dist Ubuntu Esm H88
Ubuntu Security Notice USN-6664-4 May 24, 2024, outlines a critical update for OpenSSH mitigating vulnerabilities associated with SSH connections.
Add implicit rejection in PKCS#1 v1.5 in OpenSSL.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 24.04 LTS Summary: Add implicit rejection in PKCS#1 v1.5 in OpenSSL. Software Description: - openssl: Secure Socket Layer (SSL) cryptographic library and tools Details: USN-6663-1 provided a security update for OpenSSL. This update provides the corresponding update for Ubuntu 24.04 LTS. Original advisory details:  As a security improvement, OpenSSL will now  return deterministic random bytes instead of an error  when detecting wrong padding in PKCS#1 v1.5 RSA  to prevent its use in possible Bleichenbacher timing attacks.

Topics%20covered

Topics Covered

security advisory Ubuntu OpenSSL timing attack PKCS#1

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 24.04 LTS   libssl-doc                      3.0.13-0ubuntu3.1   libssl3t64                      3.0.13-0ubuntu3.1   openssl                         3.0.13-0ubuntu3.1 After a standard system update you need to reboot your computer to make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-6663-3

  https://ubuntu.com/security/notices/USN-6663-1

  https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2054090

Ubuntu Security Notice USN-6663-3

Topics%20covered

Topics Covered

security advisory Ubuntu OpenSSL timing attack PKCS#1

Package Information

  https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubuntu3.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here