USN-7278-1: OpenSSL vulnerabilities
George Pantelakis and Alicja Kario discovered that OpenSSL had a timing side-channel when performing ECDSA signature computations. A remote attacker could possibly use this issue to recover private data. (CVE-2024-13176)
It was discovered that OpenSSL incorrectly handled certain memory operations when using low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial. When being used in this uncommon fashion, a remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-9143)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libssl3t64to a version that resolves this vulnerability.Fixed in 3.0.13-0ubuntu3.5 - Upgrade
Upgrade
ubuntu/opensslto a version that resolves this vulnerability.Fixed in 3.0.13-0ubuntu3.5 - Upgrade
Upgrade
ubuntu/libssl3to a version that resolves this vulnerability.Fixed in 3.0.2-0ubuntu1.19 - Upgrade
Upgrade
ubuntu/opensslto a version that resolves this vulnerability.Fixed in 3.0.2-0ubuntu1.19 - Upgrade
Upgrade
ubuntu/libssl1.1to a version that resolves this vulnerability.Fixed in 1.1.1f-1ubuntu2.24 - Upgrade
Upgrade
ubuntu/opensslto a version that resolves this vulnerability.Fixed in 1.1.1f-1ubuntu2.24
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-7278-1?
The severity of USN-7278-1 is classified as high due to the potential for remote attackers to recover private data.
How do I fix USN-7278-1?
To fix USN-7278-1, update the libssl3t64 or openssl packages to versions 3.0.13-0ubuntu3.5 or 3.0.2-0ubuntu1.19, depending on your Ubuntu version.
Which versions of OpenSSL are affected by USN-7278-1?
OpenSSL versions prior to 3.0.13-0ubuntu3.5 for Ubuntu 24.04 and 3.0.2-0ubuntu1.19 for Ubuntu 22.04 are affected.
What types of data can be compromised due to USN-7278-1?
Due to USN-7278-1, private keys and sensitive data during ECDSA signature computations can potentially be compromised.
Are there any specific Ubuntu versions impacted by USN-7278-1?
Yes, USN-7278-1 impacts Ubuntu 20.04, 22.04, and 24.04 for various OpenSSL and libssl packages.