DSA-4855: -1 openssl -- security update
Multiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit. An overflow bug in the x6464 Montgomery squaring procedure, an integer overflow in CipherUpdate and a NULL pointer dereference flaw X509issuerandserialhash() were found, which could result in denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opensslto a version that resolves this vulnerability.Patch DSA-4855-1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What impact can these flaws have on affected systems?
The identified issues can result in denial of service, including an overflow in the x64_64 Montgomery squaring procedure, an integer overflow in CipherUpdate, and a NULL pointer dereference in X509_issuer_and_serial_hash().
Which OpenSSL functionality is implicated?
The advisory identifies the x64_64 Montgomery squaring procedure, CipherUpdate, and X509_issuer_and_serial_hash() as affected code paths. The provided data does not specify deployment configurations, exposure conditions, or mitigations beyond applying the security update.