DSA-4355: -1 openssl1.0 -- security update
Published Dec 19, 2018
·Updated
openssl1.0 - security update
Other sources
Several local side channel attacks and a denial of service via large Diffie-Hellman parameters were discovered in OpenSSL, a Secure Sockets Layer toolkit.
Affected Software
2 affected components
debian/openssl1.0
debian/openssl1.0
Event History
Dec 19, 2018
Advisory Published
12:00 AM
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
1
What access would an attacker need to exploit the side-channel issues?
The advisory characterizes the side-channel attacks as local, so an attacker would need local access to the affected Debian system.
2
Can this update address denial of service conditions?
Yes. The advisory states that large Diffie-Hellman parameters can be used to cause a denial of service in OpenSSL.
3
Which tracked issues are covered by this update?
The update references CVE-2018-0732, CVE-2018-0734, and CVE-2018-0737.