[USN-5402-1] OpenSSL vulnerabilities

Severity Medium

Affected Packages 19

CVEs 4

Several security issues were fixed in OpenSSL.

Elison Niven discovered that OpenSSL incorrectly handled the c_rehash
script. A local attacker could possibly use this issue to execute arbitrary
commands when c_rehash is run. (CVE-2022-1292)

Raul Metsma discovered that OpenSSL incorrectly verified certain response
signing certificates. A remote attacker could possibly use this issue to
spoof certain response signing certificates. This issue only affected
Ubuntu 22.04 LTS. (CVE-2022-1343)

Tom Colley discovered that OpenSSL used the incorrect MAC key in the
RC4-MD5 ciphersuite. In non-default configurations were RC4-MD5 is enabled,
a remote attacker could possibly use this issue to modify encrypted
communications. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1434)

Aliaksei Levin discovered that OpenSSL incorrectly handled resources when
decoding certificates and keys. A remote attacker could possibly use this
issue to cause OpenSSL to consume resources, leading to a denial of
service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1473)

Package	Affected Version
pkg:deb/ubuntu/openssl?distro=jammy	< 3.0.2-0ubuntu1.1
pkg:deb/ubuntu/openssl?distro=impish	< 1.1.1l-1ubuntu1.3
pkg:deb/ubuntu/openssl?distro=focal	< 1.1.1f-1ubuntu2.13
pkg:deb/ubuntu/openssl?distro=bionic	< 1.1.1-1ubuntu2.1~18.04.17
pkg:deb/ubuntu/openssl1.0?distro=bionic	< 1.0.2n-1ubuntu5.9
pkg:deb/ubuntu/libssl3?distro=jammy	< 3.0.2-0ubuntu1.1
pkg:deb/ubuntu/libssl1.1?distro=impish	< 1.1.1l-1ubuntu1.3
pkg:deb/ubuntu/libssl1.1?distro=focal	< 1.1.1f-1ubuntu2.13
pkg:deb/ubuntu/libssl1.1?distro=bionic	< 1.1.1-1ubuntu2.1~18.04.17
pkg:deb/ubuntu/libssl1.0.0?distro=bionic	< 1.0.2n-1ubuntu5.9
pkg:deb/ubuntu/libssl1.0-dev?distro=bionic	< 1.0.2n-1ubuntu5.9
pkg:deb/ubuntu/libssl-doc?distro=jammy	< 3.0.2-0ubuntu1.1
pkg:deb/ubuntu/libssl-doc?distro=impish	< 1.1.1l-1ubuntu1.3
pkg:deb/ubuntu/libssl-doc?distro=focal	< 1.1.1f-1ubuntu2.13
pkg:deb/ubuntu/libssl-doc?distro=bionic	< 1.1.1-1ubuntu2.1~18.04.17
pkg:deb/ubuntu/libssl-dev?distro=jammy	< 3.0.2-0ubuntu1.1
pkg:deb/ubuntu/libssl-dev?distro=impish	< 1.1.1l-1ubuntu1.3
pkg:deb/ubuntu/libssl-dev?distro=focal	< 1.1.1f-1ubuntu2.13
pkg:deb/ubuntu/libssl-dev?distro=bionic	< 1.1.1-1ubuntu2.1~18.04.17

ID

USN-5402-1

Severity

medium

URL

https://ubuntu.com/security/notices/USN-5402-1

Published

2022-05-04T13:21:13
(2 years ago)

Modified

2022-05-04T13:21:13
(2 years ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/openssl?distro=jammy	ubuntu	openssl	< 3.0.2-0ubuntu1.1	jammy
Affected	pkg:deb/ubuntu/openssl?distro=impish	ubuntu	openssl	< 1.1.1l-1ubuntu1.3	impish
Affected	pkg:deb/ubuntu/openssl?distro=focal	ubuntu	openssl	< 1.1.1f-1ubuntu2.13	focal
Affected	pkg:deb/ubuntu/openssl?distro=bionic	ubuntu	openssl	< 1.1.1-1ubuntu2.1~18.04.17	bionic
Affected	pkg:deb/ubuntu/openssl1.0?distro=bionic	ubuntu	openssl1.0	< 1.0.2n-1ubuntu5.9	bionic
Affected	pkg:deb/ubuntu/libssl3?distro=jammy	ubuntu	libssl3	< 3.0.2-0ubuntu1.1	jammy
Affected	pkg:deb/ubuntu/libssl1.1?distro=impish	ubuntu	libssl1.1	< 1.1.1l-1ubuntu1.3	impish
Affected	pkg:deb/ubuntu/libssl1.1?distro=focal	ubuntu	libssl1.1	< 1.1.1f-1ubuntu2.13	focal
Affected	pkg:deb/ubuntu/libssl1.1?distro=bionic	ubuntu	libssl1.1	< 1.1.1-1ubuntu2.1~18.04.17	bionic
Affected	pkg:deb/ubuntu/libssl1.0.0?distro=bionic	ubuntu	libssl1.0.0	< 1.0.2n-1ubuntu5.9	bionic
Affected	pkg:deb/ubuntu/libssl1.0-dev?distro=bionic	ubuntu	libssl1.0-dev	< 1.0.2n-1ubuntu5.9	bionic
Affected	pkg:deb/ubuntu/libssl-doc?distro=jammy	ubuntu	libssl-doc	< 3.0.2-0ubuntu1.1	jammy
Affected	pkg:deb/ubuntu/libssl-doc?distro=impish	ubuntu	libssl-doc	< 1.1.1l-1ubuntu1.3	impish
Affected	pkg:deb/ubuntu/libssl-doc?distro=focal	ubuntu	libssl-doc	< 1.1.1f-1ubuntu2.13	focal
Affected	pkg:deb/ubuntu/libssl-doc?distro=bionic	ubuntu	libssl-doc	< 1.1.1-1ubuntu2.1~18.04.17	bionic
Affected	pkg:deb/ubuntu/libssl-dev?distro=jammy	ubuntu	libssl-dev	< 3.0.2-0ubuntu1.1	jammy
Affected	pkg:deb/ubuntu/libssl-dev?distro=impish	ubuntu	libssl-dev	< 1.1.1l-1ubuntu1.3	impish
Affected	pkg:deb/ubuntu/libssl-dev?distro=focal	ubuntu	libssl-dev	< 1.1.1f-1ubuntu2.13	focal
Affected	pkg:deb/ubuntu/libssl-dev?distro=bionic	ubuntu	libssl-dev	< 1.1.1-1ubuntu2.1~18.04.17	bionic

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date