Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 521
Alerts This Week
Warning Icon 1 521

Ubuntu 14.04 LTS USN-7018-1 Critical: OpenSSL Remote Attack Issues

ubuntu
Calendar Grey September 18, 2024
Scroller Ubuntu
Enhance your Ubuntu system to address several OpenSSL security flaws associated with remote attack vectors and denial of service exposure.
Several security issues were fixed in OpenSSL.

Summary

Several security issues were fixed in OpenSSL.

Software Description:

- openssl: Secure Socket Layer (SSL) cryptographic library and tools

Details:

Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky

discovered that certain Diffie-Hellman ciphersuites in the TLS

specification and implemented by OpenSSL contained a flaw. A remote

attacker could possibly use this issue to eavesdrop on encrypted

communications. This was fixed in this update by removing the insecure

ciphersuites from OpenSSL. (CVE-2020-1968)

Paul Kehrer discovered that OpenSSL incorrectly handled certain input

lengths in EVP functions. A remote attacker could possibly use this issue

to cause OpenSSL to crash, resulting in a denial of service.

(CVE-2021-23840)

Elison Niven discovered that OpenSSL incorrectly handled the c_rehash

script. A local attacker could possibly use this issue to execute arbitrary

commands when c_rehash is run. (CVE-2022-1292)

Chancen and Daniel Fiala ...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory security update remote attack Ubuntu OpenSSL Denial of Service

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 LTS
   libssl1.0.0                     1.0.1f-1ubuntu2.27+esm10
                                   Available with Ubuntu Pro
   openssl                         1.0.1f-1ubuntu2.27+esm10
                                   Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-7018-1

CVE-2020-1968, CVE-2021-23840, CVE-2022-1292, CVE-2022-2068,

CVE-2023-3446, CVE-2024-0727

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-7018-1

Topics%20covered

Topics Covered

security advisory security update remote attack Ubuntu OpenSSL Denial of Service

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.