DSA-4475: -1 openssl -- security update

Published Jul 1, 2019

Updated

Joran Dirk Greef discovered that overly long nonces used with ChaCha20-Poly1305 were incorrectly processed and could result in nonce reuse. This doesn't affect OpenSSL-internal uses of ChaCha20-Poly1305 such as TLS.

Affected Software

2 affected components

debian/openssl

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openssl to a version that resolves this vulnerability.
Patch DSA-4475-1

Event History

Jul 1, 2019

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2019-1543

Frequently Asked Questions

Are systems using OpenSSL for TLS affected by this issue?

No. The issue does not affect OpenSSL-internal uses of ChaCha20-Poly1305, including TLS.

What must an attacker or affected application be able to do for nonce reuse to occur?

The affected use involves ChaCha20-Poly1305 with overly long nonces. The provided information does not identify other affected use cases or exploit prerequisites.

DSA-4475: -1 openssl -- security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Are systems using OpenSSL for TLS affected by this issue?

What must an attacker or affected application be able to do for nonce reuse to occur?

Company

Resources

Contact

Frequently Asked Questions

Are systems using OpenSSL for TLS affected by this issue?

What must an attacker or affected application be able to do for nonce reuse to occur?