[USN-5402-2] OpenSSL vulnerabilities

Severity Medium

Affected Packages 4

CVEs 2

Several security issues were fixed in OpenSSL.

USN-5402-1 fixed several vulnerabilities in OpenSSL. This update provides
the corresponding update for Ubuntu 16.04 ESM.

Original advisory details:

Elison Niven discovered that OpenSSL incorrectly handled the c_rehash
script. A local attacker could possibly use this issue to execute arbitrary
commands when c_rehash is run. (CVE-2022-1292)

Aliaksei Levin discovered that OpenSSL incorrectly handled resources when
decoding certificates and keys. A remote attacker could possibly use this
issue to cause OpenSSL to consume resources, leading to a denial of
service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1473)

Package	Affected Version
pkg:deb/ubuntu/openssl?distro=xenial	< 1.0.2g-1ubuntu4.20+esm3
pkg:deb/ubuntu/libssl1.0.0?distro=xenial	< 1.0.2g-1ubuntu4.20+esm3
pkg:deb/ubuntu/libssl-doc?distro=xenial	< 1.0.2g-1ubuntu4.20+esm3
pkg:deb/ubuntu/libssl-dev?distro=xenial	< 1.0.2g-1ubuntu4.20+esm3

ID

USN-5402-2

Severity

medium

URL

https://ubuntu.com/security/notices/USN-5402-2

Published

2022-05-26T13:34:08
(2 years ago)

Modified

2022-05-26T13:34:08
(2 years ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/openssl?distro=xenial	ubuntu	openssl	< 1.0.2g-1ubuntu4.20+esm3	xenial
Affected	pkg:deb/ubuntu/libssl1.0.0?distro=xenial	ubuntu	libssl1.0.0	< 1.0.2g-1ubuntu4.20+esm3	xenial
Affected	pkg:deb/ubuntu/libssl-doc?distro=xenial	ubuntu	libssl-doc	< 1.0.2g-1ubuntu4.20+esm3	xenial
Affected	pkg:deb/ubuntu/libssl-dev?distro=xenial	ubuntu	libssl-dev	< 1.0.2g-1ubuntu4.20+esm3	xenial

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date