USN-6632-1: OpenSSL vulnerabilities
David Benjamin discovered that OpenSSL incorrectly handled excessively long X9.42 DH keys. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, leading to a denial of service. (CVE-2023-5678) Bahaa Naamneh discovered that OpenSSL incorrectly handled certain malformed PKCS12 files. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2024-0727)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libssl1.1to a version that resolves this vulnerability.Fixed in 1.1.1-1ubuntu2.1~18.04.23+esm4 - Upgrade
Upgrade
ubuntu/libssl1.0.0to a version that resolves this vulnerability.Fixed in 1.0.2g-1ubuntu4.20+esm11
Event History
Frequently Asked Questions
What is the severity of USN-6632-1?
The severity of USN-6632-1 is significant as it could lead to denial of service due to excessive resource consumption.
How do I fix USN-6632-1?
To fix USN-6632-1, upgrade to the patched version of OpenSSL available for your distribution.
Which versions of Ubuntu are affected by USN-6632-1?
USN-6632-1 affects Ubuntu 18.04 and Ubuntu 16.04 with specific versions of the libssl packages.
Who discovered the vulnerability in USN-6632-1?
The vulnerability in USN-6632-1 was discovered by David Benjamin and Bahaa Naamneh.
What type of attack does USN-6632-1 allow?
USN-6632-1 allows a remote attacker to potentially cause a denial of service by exploiting the vulnerability.