UbuntuUpdates.org

Package "libssl-doc"

Name: libssl-doc

Description:

Secure Sockets Layer toolkit - development documentation
Latest version: 3.0.13-0ubuntu3.6
Release: noble (24.04)
Level: updates
Repository: main
Head package: openssl
Homepage: https://www.openssl.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libssl-doc"

All arch deb package
APT INSTALL

Other versions of "libssl-doc" in Noble

Repository Area Version
base main 3.0.13-0ubuntu3
security main 3.0.13-0ubuntu3.6

Changelog

Version: 3.0.13-0ubuntu3.6 2025-09-30 20:07:10 UTC

  openssl (3.0.13-0ubuntu3.6) noble-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds read & write in RFC 3211 KEK Unwrap
    - debian/patches/CVE-2025-9230.patch: fix incorrect check of unwrapped
      key size in crypto/cms/cms_pwri.c.
    - CVE-2025-9230

 -- Marc Deslauriers <email address hidden> Thu, 18 Sep 2025 07:12:48 -0400
Source diff to previous version
CVE-2025-9230 Out-of-bounds read & write in RFC 3211 KEK Unwrap

Version: 3.0.13-0ubuntu3.5 2025-02-21 02:07:01 UTC

  openssl (3.0.13-0ubuntu3.5) noble-security; urgency=medium

  * SECURITY UPDATE: Low-level invalid GF(2^m) parameters lead to OOB
    memory access
    - debian/patches/CVE-2024-9143.patch: harden BN_GF2m_poly2arr against
      misuse in crypto/bn/bn_gf2m.c, test/ec_internal_test.c.
    - CVE-2024-9143
  * SECURITY UPDATE: A timing side-channel which could potentially allow
    recovering the private key exists in the ECDSA signature computation
    - debian/patches/CVE-2024-13176.patch: Fix timing side-channel in
      ECDSA signature computation in crypto/bn/bn_exp.c,
      crypto/ec/ec_lib.c, include/crypto/bn.h.
    - CVE-2024-13176

 -- Marc Deslauriers <email address hidden> Wed, 05 Feb 2025 08:17:43 -0500
Source diff to previous version
CVE-2024-9143 Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds mem
CVE-2024-13176 Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summ

Version: 3.0.13-0ubuntu3.4 2024-09-03 17:07:02 UTC

  openssl (3.0.13-0ubuntu3.4) noble-security; urgency=medium

  * SECURITY UPDATE: Possible denial of service in X.509 name checks
    - debian/patches/CVE-2024-6119.patch: avoid type errors in EAI-related
      name check logic in crypto/x509/v3_utl.c, test/*.
    - CVE-2024-6119

 -- Marc Deslauriers <email address hidden> Tue, 20 Aug 2024 13:05:36 -0400
Source diff to previous version

Version: 3.0.13-0ubuntu3.3 2024-08-22 17:07:20 UTC

  openssl (3.0.13-0ubuntu3.3) noble-proposed; urgency=medium

  * SRU: LP: #2076340: No-change rebuild to pick up changed build flags
    on ppc64 and s390x.

 -- Matthias Klose <email address hidden> Fri, 09 Aug 2024 04:33:21 +0200
Source diff to previous version

Version: 3.0.13-0ubuntu3.2 2024-07-31 19:07:07 UTC

  openssl (3.0.13-0ubuntu3.2) noble-security; urgency=medium

  * SECURITY UPDATE: unbounded mem growth when processing TLSv1.3 sessions
    - debian/patches/CVE-2024-2511.patch: fix unconstrained session cache
      growth in TLSv1.3 in ssl/ssl_lib.c, ssl/ssl_sess.c,
      ssl/statem/statem_srvr.c.
    - CVE-2024-2511
  * SECURITY UPDATE: checking excessively long DSA keys or params very slow
    - debian/patches/CVE-2024-4603.patch: check DSA parameters for
      excessive sizes before validating in crypto/dsa/dsa_check.c,
      test/recipes/15-test_dsaparam_data/invalid/p10240_q256_too_big.pem.
    - CVE-2024-4603
  * SECURITY UPDATE: use after free with SSL_free_buffers
    - debian/patches/CVE-2024-4741.patch: only free the read buffers if
      we're not using them in ssl/record/rec_layer_s3.c,
      ssl/record/record.h, ssl/ssl_lib.c.
    - CVE-2024-4741
  * SECURITY UPDATE: crash or memory disclosure via SSL_select_next_proto
    - debian/patches/CVE-2024-5535.patch: validate provided client list in
      ssl/ssl_lib.c.
    - CVE-2024-5535

 -- Marc Deslauriers <email address hidden> Tue, 30 Jul 2024 11:03:13 -0400
CVE-2024-2511 Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An atta
CVE-2024-4603 Issue summary: Checking excessively long DSA keys or parameters may be very slow. Impact summary: Applications that use the functions EVP_PKEY_param
CVE-2024-4741 Use After Free with SSL_free_buffers
CVE-2024-5535 Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory con


About   -   Send Feedback to @ubuntu_updates