[SECURITY] [DLA 2952-1] openssl security update

2022-03-1709:48:17

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.013 Low

EPSS

Percentile

85.9%

JSON

Debian LTS Advisory DLA-2952-1 [email protected]
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
March 17, 2022 https://wiki.debian.org/LTS

Package : openssl
Version : 1.1.0l-1~deb9u5
CVE ID : CVE-2019-1551 CVE-2022-0778

Tavis Ormandy discovered that the BN_mod_sqrt() function of OpenSSL
could be tricked into an infinite loop. This could result in denial of
service via malformed certificates.

In addition, this update fixes an overflow bug in the x64_64 Montgomery
squaring procedure.

For Debian 9 stretch, these problems have been fixed in version
1.1.0l-1~deb9u5.

We recommend that you upgrade your openssl packages.

For the detailed security status of openssl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openssl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10s390xopenssl-dbgsym< 1.1.1d-0+deb10u8openssl-dbgsym_1.1.1d-0+deb10u8_s390x.deb
Debian9amd64libssl1.0-dev< 1.0.2u-1~deb9u7libssl1.0-dev_1.0.2u-1~deb9u7_amd64.deb
Debian10mips64ellibssl1.1-dbgsym< 1.1.1d-0+deb10u8libssl1.1-dbgsym_1.1.1d-0+deb10u8_mips64el.deb
Debian10armhflibssl1.1< 1.1.1d-0+deb10u8libssl1.1_1.1.1d-0+deb10u8_armhf.deb
Debian11i386libssl1.1< 1.1.1k-1+deb11u2libssl1.1_1.1.1k-1+deb11u2_i386.deb
Debian11armellibssl1.1< 1.1.1k-1+deb11u2libssl1.1_1.1.1k-1+deb11u2_armel.deb
Debian11armellibcrypto1.1-udeb< 1.1.1k-1+deb11u2libcrypto1.1-udeb_1.1.1k-1+deb11u2_armel.deb
Debian9armhflibssl-dev< 1.1.0l-1~deb9u5libssl-dev_1.1.0l-1~deb9u5_armhf.deb
Debian10allopenssl< 1.1.1d-0+deb10u8openssl_1.1.1d-0+deb10u8_all.deb
Debian10armellibssl1.1-udeb< 1.1.1d-0+deb10u8libssl1.1-udeb_1.1.1d-0+deb10u8_armel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	s390x	openssl-dbgsym	< 1.1.1d-0+deb10u8	openssl-dbgsym_1.1.1d-0+deb10u8_s390x.deb
Debian	9	amd64	libssl1.0-dev	< 1.0.2u-1~deb9u7	libssl1.0-dev_1.0.2u-1~deb9u7_amd64.deb
Debian	10	mips64el	libssl1.1-dbgsym	< 1.1.1d-0+deb10u8	libssl1.1-dbgsym_1.1.1d-0+deb10u8_mips64el.deb
Debian	10	armhf	libssl1.1	< 1.1.1d-0+deb10u8	libssl1.1_1.1.1d-0+deb10u8_armhf.deb
Debian	11	i386	libssl1.1	< 1.1.1k-1+deb11u2	libssl1.1_1.1.1k-1+deb11u2_i386.deb
Debian	11	armel	libssl1.1	< 1.1.1k-1+deb11u2	libssl1.1_1.1.1k-1+deb11u2_armel.deb
Debian	11	armel	libcrypto1.1-udeb	< 1.1.1k-1+deb11u2	libcrypto1.1-udeb_1.1.1k-1+deb11u2_armel.deb
Debian	9	armhf	libssl-dev	< 1.1.0l-1~deb9u5	libssl-dev_1.1.0l-1~deb9u5_armhf.deb
Debian	10	all	openssl	< 1.1.1d-0+deb10u8	openssl_1.1.1d-0+deb10u8_all.deb
Debian	10	armel	libssl1.1-udeb	< 1.1.1d-0+deb10u8	libssl1.1-udeb_1.1.1d-0+deb10u8_armel.deb