[USN-5845-2] OpenSSL vulnerabilities

Severity High

Affected Packages 8

CVEs 2

Several security issues were fixed in OpenSSL.

USN-5845-1 fixed several vulnerabilities in OpenSSL. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

David Benjamin discovered that OpenSSL incorrectly handled X.400 address
processing. A remote attacker could possibly use this issue to read
arbitrary memory contents or cause OpenSSL to crash, resulting in a denial
of service. (CVE-2023-0286)

Octavio Galland and Marcel Böhme discovered that OpenSSL incorrectly
handled streaming ASN.1 data. A remote attacker could use this issue to
cause OpenSSL to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2023-0215)

Package	Affected Version
pkg:deb/ubuntu/openssl?distro=xenial	< 1.0.2g-1ubuntu4.20+esm6
pkg:deb/ubuntu/openssl?distro=trusty	< 1.0.1f-1ubuntu2.27+esm6
pkg:deb/ubuntu/libssl1.0.0?distro=xenial	< 1.0.2g-1ubuntu4.20+esm6
pkg:deb/ubuntu/libssl1.0.0?distro=trusty	< 1.0.1f-1ubuntu2.27+esm6
pkg:deb/ubuntu/libssl-doc?distro=xenial	< 1.0.2g-1ubuntu4.20+esm6
pkg:deb/ubuntu/libssl-doc?distro=trusty	< 1.0.1f-1ubuntu2.27+esm6
pkg:deb/ubuntu/libssl-dev?distro=xenial	< 1.0.2g-1ubuntu4.20+esm6
pkg:deb/ubuntu/libssl-dev?distro=trusty	< 1.0.1f-1ubuntu2.27+esm6

ID

USN-5845-2

Severity

high

Severity from

CVE-2023-0215

URL

https://ubuntu.com/security/notices/USN-5845-2

Published

2023-02-07T20:06:40
(19 months ago)

Modified

2023-02-07T20:06:40
(19 months ago)

Other Advisories

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:deb/ubuntu/openssl?distro=xenial	ubuntu	openssl	< 1.0.2g-1ubuntu4.20+esm6	xenial
Affected	pkg:deb/ubuntu/openssl?distro=trusty	ubuntu	openssl	< 1.0.1f-1ubuntu2.27+esm6	trusty
Affected	pkg:deb/ubuntu/libssl1.0.0?distro=xenial	ubuntu	libssl1.0.0	< 1.0.2g-1ubuntu4.20+esm6	xenial
Affected	pkg:deb/ubuntu/libssl1.0.0?distro=trusty	ubuntu	libssl1.0.0	< 1.0.1f-1ubuntu2.27+esm6	trusty
Affected	pkg:deb/ubuntu/libssl-doc?distro=xenial	ubuntu	libssl-doc	< 1.0.2g-1ubuntu4.20+esm6	xenial
Affected	pkg:deb/ubuntu/libssl-doc?distro=trusty	ubuntu	libssl-doc	< 1.0.1f-1ubuntu2.27+esm6	trusty
Affected	pkg:deb/ubuntu/libssl-dev?distro=xenial	ubuntu	libssl-dev	< 1.0.2g-1ubuntu4.20+esm6	xenial
Affected	pkg:deb/ubuntu/libssl-dev?distro=trusty	ubuntu	libssl-dev	< 1.0.1f-1ubuntu2.27+esm6	trusty

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date