DSA-4540: -1 openssl1.0 -- security update
Published Oct 1, 2019
·Updated
openssl1.0 - security update
Other sources
Two security issues were discovered in OpenSSL: A timing attack against ECDSA and a padding oracle in PKCS7dataDecode() and CMSdecryptset1pkey().
Affected Software
2 affected components
debian/openssl1.0
debian/openssl1.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl1.0to a version that resolves this vulnerability.Patch DSA-4540-1
Event History
Oct 1, 2019
Advisory Published
12:00 AM
Frequently Asked Questions
1
What attack techniques are addressed by this update?
The update addresses a timing attack against ECDSA and a padding-oracle issue in PKCS7_dataDecode() and CMS_decrypt_set1_pkey().
2
Which identifiers can be used to track the individual issues?
The issues are tracked as CVE-2019-1547 and CVE-2019-1563 in the Debian security tracker.