USN-5051-1: OpenSSL vulnerabilities
John Ouyang discovered that OpenSSL incorrectly handled decrypting SM2 data. A remote attacker could use this issue to cause applications using OpenSSL to crash, resulting in a denial of service, or possibly change application behaviour. (CVE-2021-3711) Ingo Schwarze discovered that OpenSSL incorrectly handled certain ASN.1 strings. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2021-3712)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-5051-1?
The severity of USN-5051-1 is considered high due to the potential for denial of service and application behavior changes.
How do I fix USN-5051-1?
To fix USN-5051-1, upgrade to the latest version of the libssl1.1 package specific to your Ubuntu version.
What applications are affected by USN-5051-1?
Applications using affected versions of OpenSSL are vulnerable to the issues described in USN-5051-1.
Can USN-5051-1 lead to remote code execution?
While USN-5051-1 can cause crashes and denial of service, it does not directly enable remote code execution.
Who discovered the vulnerability in USN-5051-1?
John Ouyang and Ingo Schwarze are the researchers who discovered the vulnerabilities addressed in USN-5051-1.