USN-5328-1: OpenSSL vulnerability
Tavis Ormandy discovered that OpenSSL incorrectly parsed certain certificates. A remote attacker could possibly use this issue to cause OpenSSH to stop responding, resulting in a denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this OpenSSL vulnerability?
The vulnerability ID is CVE-2022-0778.
How can a remote attacker exploit CVE-2022-0778?
A remote attacker could exploit this vulnerability by using specially crafted certificates to cause OpenSSH to stop responding, resulting in a denial of service.
Which versions of libssl1.1 are affected by this vulnerability?
The affected versions are libssl1.1 versions 1.1.1l-1ubuntu1.2, 1.1.1f-1ubuntu2.12, and 1.1.1-1ubuntu2.1~18.04.15.
Which versions of libssl1.0.0 are affected by this vulnerability?
The affected version is libssl1.0.0 version 1.0.2n-1ubuntu5.8.
How can I fix the OpenSSL vulnerability?
To fix the vulnerability, you should update libssl1.1 to the recommended versions: 1.1.1l-1ubuntu1.2, 1.1.1f-1ubuntu2.12, or 1.1.1-1ubuntu2.1~18.04.15. Additionally, update libssl1.0.0 to version 1.0.2n-1ubuntu5.8.