USN-5845-1: OpenSSL vulnerabilities

Releases

• Ubuntu 18.04 ESM

Packages

• openssl1.0 - Secure Socket Layer (SSL) cryptographic library and tools

Details

David Benjamin discovered that OpenSSL incorrectly handled X.400 address
processing. A remote attacker could possibly use this issue to read
arbitrary memory contents or cause OpenSSL to crash, resulting in a denial
of service. (CVE-2023-0286)

Octavio Galland and Marcel Böhme discovered that OpenSSL incorrectly
handled streaming ASN.1 data. A remote attacker could use this issue to
cause OpenSSL to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2023-0215)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.04

• libssl1.0.0 - 1.0.2n-1ubuntu5.11

After a standard system update you need to reboot your computer to make all
the necessary changes.

References

• CVE-2023-0286
• CVE-2023-0215

Related notices

• USN-5844-1: libssl1.1, openssl, libssl-doc, libssl3, libssl-dev
• USN-5845-2: libssl-dev, libssl-doc, openssl, libssl1.0.0
• USN-6564-1: nodejs, libnode72, libnode-dev, nodejs-doc