DSA-4539: -1 openssl -- security update
Published Oct 1, 2019
·Updated
openssl - security update
Other sources
Three security issues were discovered in OpenSSL: A timing attack against ECDSA, a padding oracle in PKCS7dataDecode() and CMSdecryptset1pkey() and it was discovered that a feature of the random number generator (RNG) intended to protect against shared RNG state between parent and child processes in the event of a fork() syscall was not used by default.
Affected Software
2 affected components
debian/openssl
debian/openssl
Event History
Oct 1, 2019
Advisory Published
12:00 AM
Frequently Asked Questions
1
Which OpenSSL components or operations are implicated by the reported issues?
The issues involve ECDSA timing behavior, PKCS7_dataDecode(), CMS_decrypt_set1_pkey(), and RNG behavior after a fork() system call.
2
Is the RNG protection against parent and child processes sharing state enabled by default?
No. The feature intended to prevent shared RNG state between parent and child processes after fork() was not used by default.
3
Which specific vulnerabilities are covered by this update?
The update references CVE-2019-1547, CVE-2019-1549, and CVE-2019-1563.