[SECURITY] [DSA 2833-1] openssl security update

2014-01-0112:09:10

lists.debian.org

5.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

0.025 Low

EPSS

Percentile

89.9%

JSON

Debian Security Advisory DSA-2833-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
January 01, 2014 http://www.debian.org/security/faq

Package : openssl
Vulnerability : several
Problem type : local
Debian-specific: no
CVE ID : CVE-2013-6449 CVE-2013-6450
Debian Bug : 732754 732710

Multiple security issues have been fixed in OpenSSL: The TLS 1.2 support
was susceptible to denial of service and retransmission of DTLS messages
was fixed. In addition this updates disables the insecure Dual_EC_DRBG
algorithm (which was unused anyway, see
http://marc.info/?l=openssl-announce&m=138747119822324&w=2 for further
information) and no longer uses the RdRand feature available on some
Intel CPUs as a sole source of entropy unless explicitly requested.

For the stable distribution (wheezy), these problems have been fixed in
version 1.0.1e-2+deb7u1.

For the unstable distribution (sid), these problems have been fixed in
version 1.0.1e-5.

We recommend that you upgrade your openssl packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian7s390xlibssl-dev< 1.0.1e-2+deb7u1libssl-dev_1.0.1e-2+deb7u1_s390x.deb
Debian7i386libssl1.0.0< 1.0.1e-2+deb7u1libssl1.0.0_1.0.1e-2+deb7u1_i386.deb
Debian7powerpclibssl1.0.0-dbg< 1.0.1e-2+deb7u1libssl1.0.0-dbg_1.0.1e-2+deb7u1_powerpc.deb
Debian7allopenssl< 1.0.1e-2+deb7u1openssl_1.0.1e-2+deb7u1_all.deb
Debian7i386openssl< 1.0.1e-2+deb7u1openssl_1.0.1e-2+deb7u1_i386.deb
Debian7kfreebsd-amd64libcrypto1.0.0-udeb< 1.0.1e-2+deb7u1libcrypto1.0.0-udeb_1.0.1e-2+deb7u1_kfreebsd-amd64.deb
Debian7kfreebsd-i386libcrypto1.0.0-udeb< 1.0.1e-2+deb7u1libcrypto1.0.0-udeb_1.0.1e-2+deb7u1_kfreebsd-i386.deb
Debian7sparclibcrypto1.0.0-udeb< 1.0.1e-2+deb7u1libcrypto1.0.0-udeb_1.0.1e-2+deb7u1_sparc.deb
Debian7kfreebsd-amd64libssl1.0.0< 1.0.1e-2+deb7u1libssl1.0.0_1.0.1e-2+deb7u1_kfreebsd-amd64.deb
Debian7mipsopenssl< 1.0.1e-2+deb7u1openssl_1.0.1e-2+deb7u1_mips.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	s390x	libssl-dev	< 1.0.1e-2+deb7u1	libssl-dev_1.0.1e-2+deb7u1_s390x.deb
Debian	7	i386	libssl1.0.0	< 1.0.1e-2+deb7u1	libssl1.0.0_1.0.1e-2+deb7u1_i386.deb
Debian	7	powerpc	libssl1.0.0-dbg	< 1.0.1e-2+deb7u1	libssl1.0.0-dbg_1.0.1e-2+deb7u1_powerpc.deb
Debian	7	all	openssl	< 1.0.1e-2+deb7u1	openssl_1.0.1e-2+deb7u1_all.deb
Debian	7	i386	openssl	< 1.0.1e-2+deb7u1	openssl_1.0.1e-2+deb7u1_i386.deb
Debian	7	kfreebsd-amd64	libcrypto1.0.0-udeb	< 1.0.1e-2+deb7u1	libcrypto1.0.0-udeb_1.0.1e-2+deb7u1_kfreebsd-amd64.deb
Debian	7	kfreebsd-i386	libcrypto1.0.0-udeb	< 1.0.1e-2+deb7u1	libcrypto1.0.0-udeb_1.0.1e-2+deb7u1_kfreebsd-i386.deb
Debian	7	sparc	libcrypto1.0.0-udeb	< 1.0.1e-2+deb7u1	libcrypto1.0.0-udeb_1.0.1e-2+deb7u1_sparc.deb
Debian	7	kfreebsd-amd64	libssl1.0.0	< 1.0.1e-2+deb7u1	libssl1.0.0_1.0.1e-2+deb7u1_kfreebsd-amd64.deb
Debian	7	mips	openssl	< 1.0.1e-2+deb7u1	openssl_1.0.1e-2+deb7u1_mips.deb