[SECURITY] [DLA 3530-1] openssl security update

2023-08-1605:56:34

lists.debian.org

dos

update

openssl

long dh key

debian 10 buster

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

6.7

Confidence

High

EPSS

0.005

Percentile

77.2%

JSON

Debian LTS Advisory DLA-3530-1 [email protected]
https://www.debian.org/lts/security/ Anton Gladky
August 15, 2023 https://wiki.debian.org/LTS

Package : openssl
Version : 1.1.1n-0+deb10u6
CVE ID : CVE-2023-3446 CVE-2023-3817

Two vunerabilities were discovered in openssl, a Secure Sockets Layer toolkit:

CVE-2023-3446, CVE-2023-3817

Excessively long DH key or parameter checks can cause significant delays
in applications using DH_check(), DH_check_ex(), or EVP_PKEY_param_check()
functions, potentially leading to Denial of Service attacks when keys or
parameters are obtained from untrusted sources.

For Debian 10 buster, these problems have been fixed in version
1.1.1n-0+deb10u6.

We recommend that you upgrade your openssl packages.

For the detailed security status of openssl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openssl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11armhfopenssl-dbgsym< 1.1.1v-0~deb11u1openssl-dbgsym_1.1.1v-0~deb11u1_armhf.deb
Debian12armhflibssl-dev< 3.0.10-1~deb12u1libssl-dev_3.0.10-1~deb12u1_armhf.deb
Debian10amd64libssl-dev< 1.1.1n-0+deb10u6libssl-dev_1.1.1n-0+deb10u6_amd64.deb
Debian10arm64openssl-dbgsym< 1.1.1n-0+deb10u6openssl-dbgsym_1.1.1n-0+deb10u6_arm64.deb
Debian11arm64openssl< 1.1.1v-0~deb11u1openssl_1.1.1v-0~deb11u1_arm64.deb
Debian12ppc64ellibssl3-dbgsym< 3.0.10-1~deb12u1libssl3-dbgsym_3.0.10-1~deb12u1_ppc64el.deb
Debian12mipsellibssl3-udeb< 3.0.10-1~deb12u1libssl3-udeb_3.0.10-1~deb12u1_mipsel.deb
Debian11mipsellibssl1.1-dbgsym< 1.1.1v-0~deb11u1libssl1.1-dbgsym_1.1.1v-0~deb11u1_mipsel.deb
Debian10arm64openssl< 1.1.1n-0+deb10u6openssl_1.1.1n-0+deb10u6_arm64.deb
Debian12i386openssl< 3.0.10-1~deb12u1openssl_3.0.10-1~deb12u1_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	armhf	openssl-dbgsym	< 1.1.1v-0~deb11u1	openssl-dbgsym_1.1.1v-0~deb11u1_armhf.deb
Debian	12	armhf	libssl-dev	< 3.0.10-1~deb12u1	libssl-dev_3.0.10-1~deb12u1_armhf.deb
Debian	10	amd64	libssl-dev	< 1.1.1n-0+deb10u6	libssl-dev_1.1.1n-0+deb10u6_amd64.deb
Debian	10	arm64	openssl-dbgsym	< 1.1.1n-0+deb10u6	openssl-dbgsym_1.1.1n-0+deb10u6_arm64.deb
Debian	11	arm64	openssl	< 1.1.1v-0~deb11u1	openssl_1.1.1v-0~deb11u1_arm64.deb
Debian	12	ppc64el	libssl3-dbgsym	< 3.0.10-1~deb12u1	libssl3-dbgsym_3.0.10-1~deb12u1_ppc64el.deb
Debian	12	mipsel	libssl3-udeb	< 3.0.10-1~deb12u1	libssl3-udeb_3.0.10-1~deb12u1_mipsel.deb
Debian	11	mipsel	libssl1.1-dbgsym	< 1.1.1v-0~deb11u1	libssl1.1-dbgsym_1.1.1v-0~deb11u1_mipsel.deb
Debian	10	arm64	openssl	< 1.1.1n-0+deb10u6	openssl_1.1.1n-0+deb10u6_arm64.deb
Debian	12	i386	openssl	< 3.0.10-1~deb12u1	openssl_3.0.10-1~deb12u1_i386.deb