USN-3628-1: OpenSSL vulnerability

Reference Links

• https://ubuntu.com/security/CVE-2018-0737
• https://ubuntu.com/security/notices/USN-3628-2
• https://ubuntu.com/security/notices/USN-3692-1
• https://ubuntu.com/security/notices/USN-3692-2
• https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu13.5
• https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.12
• https://launchpad.net/ubuntu/+source/openssl/1.0.1f-1ubuntu2.25
• https://ubuntu.com/security/notices/USN-3628-1 (Advisory)

Child vulnerabilities

(Contains the following vulnerabilities)

• CVE-2018-0737

Frequently Asked Questions

• What is the USN for this OpenSSL vulnerability?

  The USN for this OpenSSL vulnerability is USN-3628-1.

• Who discovered the OpenSSL vulnerability?

  Alejandro Cabrera Aldaya, Billy Brumley, Cesar Pereida Garcia, and Luis Manuel Alvarez Tapia discovered the OpenSSL vulnerability.

• What is the impact of this OpenSSL vulnerability?

  The OpenSSL vulnerability allows an attacker to perform a cache-timing attack and recover private RSA keys.

• Which versions of libssl1.0.0 are affected by this vulnerability?

  The versions affected by this OpenSSL vulnerability are 1.0.2g-1ubuntu13.5, 1.0.2g-1ubuntu4.12, and 1.0.1f-1ubuntu2.25.

• How can I fix this OpenSSL vulnerability?

  To fix this OpenSSL vulnerability, update libssl1.0.0 to the appropriate remedial versions: 1.0.2g-1ubuntu13.5, 1.0.2g-1ubuntu4.12, or 1.0.1f-1ubuntu2.25.