UbuntuUpdates.org

Package "libssl-doc"

Name: libssl-doc

Description:

Secure Sockets Layer toolkit - development documentation
Latest version: 3.3.1-2ubuntu2.1
Release: oracular (24.10)
Level: security
Repository: main
Head package: openssl
Homepage: https://www.openssl.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libssl-doc"

All arch deb package
APT INSTALL

Other versions of "libssl-doc" in Oracular

Repository Area Version
base main 3.3.1-2ubuntu2
updates main 3.3.1-2ubuntu2.1

Changelog

Version: 3.3.1-2ubuntu2.1 2025-02-11 21:06:51 UTC

  openssl (3.3.1-2ubuntu2.1) oracular-security; urgency=medium

  * SECURITY UPDATE: Low-level invalid GF(2^m) parameters lead to OOB
    memory access
    - debian/patches/CVE-2024-9143.patch: harden BN_GF2m_poly2arr against
      misuse in crypto/bn/bn_gf2m.c, test/ec_internal_test.c.
    - CVE-2024-9143
  * SECURITY UPDATE: A timing side-channel which could potentially allow
    recovering the private key exists in the ECDSA signature computation
    - debian/patches/CVE-2024-13176.patch: Fix timing side-channel in
      ECDSA signature computation in crypto/bn/bn_exp.c,
      crypto/ec/ec_lib.c, include/crypto/bn.h.
    - CVE-2024-13176
  * SECURITY UPDATE: RFC7250 handshakes with unauthenticated servers don't
    abort as expected
    - debian/patches/CVE-2024-12797-1.patch: with SSL_VERIFY_PEER client
      RPK should abort on X509 error in ssl/statem/statem_clnt.c,
      test/rpktest.c.
    - debian/patches/CVE-2024-12797-2.patch: use ERR marks also when
      verifying server X.509 certs in ssl/statem/statem_clnt.c,
      test/rpktest.c.
    - CVE-2024-12797
  * debian/patches/issue26466.patch: restore correct registers in aarch64
    AES-CTR code in crypto/aes/asm/aesv8-armx.pl.

 -- Marc Deslauriers <email address hidden> Wed, 05 Feb 2025 07:56:37 -0500
CVE-2024-9143 Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds mem
CVE-2024-13176 Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summ
CVE-2024-12797 Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authent ...


About   -   Send Feedback to @ubuntu_updates