USN-5402-1: OpenSSL vulnerabilities
4 May 2022
Several security issues were fixed in OpenSSL.
Releases
Packages
- openssl - Secure Socket Layer (SSL) cryptographic library and tools
- openssl1.0 - Secure Socket Layer (SSL) cryptographic library and tools
Details
Elison Niven discovered that OpenSSL incorrectly handled the c_rehash
script. A local attacker could possibly use this issue to execute arbitrary
commands when c_rehash is run. (CVE-2022-1292)
Raul Metsma discovered that OpenSSL incorrectly verified certain response
signing certificates. A remote attacker could possibly use this issue to
spoof certain response signing certificates. This issue only affected
Ubuntu 22.04 LTS. (CVE-2022-1343)
Tom Colley discovered that OpenSSL used the incorrect MAC key in the
RC4-MD5 ciphersuite. In non-default configurations were RC4-MD5 is enabled,
a remote attacker could possibly use this issue to modify encrypted
communications. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1434)
Aliaksei Levin discovered that OpenSSL incorrectly handled resources when
decoding certificates and keys. A remote attacker could possibly use this
issue to cause OpenSSL to consume resources, leading to a denial of
service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1473)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04
Ubuntu 21.10
Ubuntu 20.04
Ubuntu 18.04
After a standard system update you need to reboot your computer to make
all the necessary changes.
References
Related notices
- USN-5402-2: openssl, libssl-dev, libssl-doc, libssl1.0.0
- USN-6457-1: libnode72, nodejs, nodejs-doc, libnode-dev
- USN-7018-1: openssl, libssl-dev, libssl-doc, libssl1.0.0
- USN-7060-1: qemu-efi-aarch64, qemu-efi, ovmf, qemu-efi-arm, edk2, ovmf-ia32