USN-4738-1: OpenSSL vulnerabilities
Paul Kehrer discovered that OpenSSL incorrectly handled certain input lengths in EVP functions. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2021-23840) Tavis Ormandy discovered that OpenSSL incorrectly handled parsing issuer fields. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2021-23841)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libssl1.1to a version that resolves this vulnerability.Fixed in 1.1.1f-1ubuntu4.2 - Upgrade
Upgrade
ubuntu/libssl1.1to a version that resolves this vulnerability.Fixed in 1.1.1f-1ubuntu2.2 - Upgrade
Upgrade
ubuntu/libssl1.0.0to a version that resolves this vulnerability.Fixed in 1.0.2n-1ubuntu5.6 - Upgrade
Upgrade
ubuntu/libssl1.1to a version that resolves this vulnerability.Fixed in 1.1.1-1ubuntu2.1~18.04.8 - Upgrade
Upgrade
ubuntu/libssl1.0.0to a version that resolves this vulnerability.Fixed in 1.0.2g-1ubuntu4.19
Event History
Frequently Asked Questions
What is the severity of USN-4738-1?
USN-4738-1 is classified as a denial of service vulnerability that could allow a remote attacker to crash OpenSSL.
How do I fix USN-4738-1?
To fix USN-4738-1, you should upgrade the OpenSSL package to the latest recommended version for your Ubuntu release.
Which versions of Ubuntu are affected by USN-4738-1?
USN-4738-1 affects multiple versions of Ubuntu, including 16.04, 18.04, 20.04, and 20.10.
What components are impacted by USN-4738-1?
The libssl1.0.0 and libssl1.1 packages in Ubuntu are impacted by the vulnerability detailed in USN-4738-1.
Is there a known exploit for USN-4738-1?
As of now, there are no publicly disclosed exploits specifically targeting the vulnerability detailed in USN-4738-1.