Package "libssl3t64"
| Name: |
libssl3t64
|
Description: |
Secure Sockets Layer toolkit - shared libraries
|
| Latest version: |
3.3.1-2ubuntu2.1 |
| Release: |
oracular (24.10) |
| Level: |
updates |
| Repository: |
main |
| Head package: |
openssl |
| Homepage: |
https://www.openssl.org/ |
Links
Download "libssl3t64"
Other versions of "libssl3t64" in Oracular
Changelog
|
openssl (3.3.1-2ubuntu2.1) oracular-security; urgency=medium
* SECURITY UPDATE: Low-level invalid GF(2^m) parameters lead to OOB
memory access
- debian/patches/CVE-2024-9143.patch: harden BN_GF2m_poly2arr against
misuse in crypto/bn/bn_gf2m.c, test/ec_internal_test.c.
- CVE-2024-9143
* SECURITY UPDATE: A timing side-channel which could potentially allow
recovering the private key exists in the ECDSA signature computation
- debian/patches/CVE-2024-13176.patch: Fix timing side-channel in
ECDSA signature computation in crypto/bn/bn_exp.c,
crypto/ec/ec_lib.c, include/crypto/bn.h.
- CVE-2024-13176
* SECURITY UPDATE: RFC7250 handshakes with unauthenticated servers don't
abort as expected
- debian/patches/CVE-2024-12797-1.patch: with SSL_VERIFY_PEER client
RPK should abort on X509 error in ssl/statem/statem_clnt.c,
test/rpktest.c.
- debian/patches/CVE-2024-12797-2.patch: use ERR marks also when
verifying server X.509 certs in ssl/statem/statem_clnt.c,
test/rpktest.c.
- CVE-2024-12797
* debian/patches/issue26466.patch: restore correct registers in aarch64
AES-CTR code in crypto/aes/asm/aesv8-armx.pl.
-- Marc Deslauriers <email address hidden> Wed, 05 Feb 2025 07:56:37 -0500
|
| CVE-2024-9143 |
Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds mem |
| CVE-2024-13176 |
Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summ |
| CVE-2024-12797 |
Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authent ... |
|
About
-
Send Feedback to @ubuntu_updates
