USN-3628-1: OpenSSL vulnerability
Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia and Luis Manuel Alvarez Tapia discovered that OpenSSL incorrectly handled RSA key generation. An attacker could possibly use this issue to perform a cache-timing attack and recover private RSA keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libssl1.0.0to a version that resolves this vulnerability.Fixed in 1.0.2g-1ubuntu13.5 - Upgrade
Upgrade
ubuntu/libssl1.0.0to a version that resolves this vulnerability.Fixed in 1.0.2g-1ubuntu4.12 - Upgrade
Upgrade
ubuntu/libssl1.0.0to a version that resolves this vulnerability.Fixed in 1.0.1f-1ubuntu2.25
Event History
Frequently Asked Questions
What is the USN for this OpenSSL vulnerability?
The USN for this OpenSSL vulnerability is USN-3628-1.
Who discovered the OpenSSL vulnerability?
Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia, and Luis Manuel Alvarez Tapia discovered the OpenSSL vulnerability.
What is the impact of this OpenSSL vulnerability?
The OpenSSL vulnerability allows an attacker to perform a cache-timing attack and recover private RSA keys.
Which versions of libssl1.0.0 are affected by this vulnerability?
The versions affected by this OpenSSL vulnerability are 1.0.2g-1ubuntu13.5, 1.0.2g-1ubuntu4.12, and 1.0.1f-1ubuntu2.25.
How can I fix this OpenSSL vulnerability?
To fix this OpenSSL vulnerability, update libssl1.0.0 to the appropriate remedial versions: 1.0.2g-1ubuntu13.5, 1.0.2g-1ubuntu4.12, or 1.0.1f-1ubuntu2.25.