security advisoryhigh severitydebian
Tibor Jager, Jörg Schwenk, and Juraj Somorovsky, from Horst Görtz Institute for IT Security, published a paper in ESORICS 2015 where they describe an invalid curve attack in Bouncy Castle Crypto, a Java library for cryptography. An attacker is able to recover private Elliptic Curve . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3417-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Luciano Bello December 14, 2015 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : bouncycastle CVE ID : CVE-2015-7940 Debian Bug : 802671 Tibor Jager, Jörg Schwenk, and Juraj Somorovsky, from Horst Görtz Institute for IT Security, published a paper in ESORICS 2015 where they describe an invalid curve attack in Bouncy Castle Crypto, a Java library for cryptography. An attacker is able to recover private Elliptic Curve keys from different applications, for example, TLS servers. More information: https://web-in-security.blogspot.com/2015/09/practical-invalid-curve-attacks.html Practical Invalid Curve Attacks on TLS-ECDH: For the oldstable distribution (wheezy), this problem has been fixed in version 1.44+dfsg-3.1+deb7u1. For the stable distribution (jessie), this problem has been fixed in version 1.49+dfsg-3+deb8u1. For the unstable distribution (sid), this problem has been fixed in version 1.51-2. We recommend that you upgrade your bouncycastle packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Debian security notice DSA-3418-2 highlights severe vulnerabilities in the libssl package, recommending prompt action for software updates.. Bouncycastle Security,Invalid Curve Attack,Debian Update,JavaCryptography,Security Advisory. . LinuxSecurity.com Team
Dec 14, 2015
Debian