USN-7278-1: OpenSSL vulnerabilities

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• openssl - Secure Socket Layer (SSL) cryptographic library and tools

Details

George Pantelakis and Alicja Kario discovered that OpenSSL had a timing
side-channel when performing ECDSA signature computations. A remote
attacker could possibly use this issue to recover private data.
(CVE-2024-13176)

It was discovered that OpenSSL incorrectly handled certain memory
operations when using low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial. When being used in this uncommon
fashion, a remote attacker could use this issue to cause OpenSSL to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2024-9143)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• libssl3t64 - 3.0.13-0ubuntu3.5
• openssl - 3.0.13-0ubuntu3.5

Ubuntu 22.04

• libssl3 - 3.0.2-0ubuntu1.19
• openssl - 3.0.2-0ubuntu1.19

Ubuntu 20.04

• libssl1.1 - 1.1.1f-1ubuntu2.24
• openssl - 1.1.1f-1ubuntu2.24

After a standard system update you need to reboot your computer to make all
the necessary changes.

References

• CVE-2024-13176
• CVE-2024-9143

Related notices

• USN-7264-1