[SECURITY] [DSA 4855-1] openssl security update

2021-02-1713:40:59

lists.debian.org

102

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

0.004 Low

EPSS

Percentile

73.8%

JSON

Debian Security Advisory DSA-4855-1 [email protected]
https://www.debian.org/security/ Salvatore Bonaccorso
February 17, 2021 https://www.debian.org/security/faq

Package : openssl
CVE ID : CVE-2019-1551 CVE-2021-23840 CVE-2021-23841
Debian Bug : 947949

Multiple vulnerabilities have been discovered in OpenSSL, a Secure
Sockets Layer toolkit. An overflow bug in the x64_64 Montgomery squaring
procedure, an integer overflow in CipherUpdate and a NULL pointer
dereference flaw X509_issuer_and_serial_hash() were found, which could
result in denial of service.

Additional details can be found in the upstream advisories
https://www.openssl.org/news/secadv/20191206.txt and
https://www.openssl.org/news/secadv/20210216.txt .

For the stable distribution (buster), these problems have been fixed in
version 1.1.1d-0+deb10u5.

We recommend that you upgrade your openssl packages.

For the detailed security status of openssl please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/openssl

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]

OSVersionArchitecturePackageVersionFilename
Debian10armellibssl-dev< 1.1.1d-0+deb10u5libssl-dev_1.1.1d-0+deb10u5_armel.deb
Debian9i386libssl-dev< 1.1.0l-1~deb9u3libssl-dev_1.1.0l-1~deb9u3_i386.deb
Debian9armellibssl1.1< 1.1.0l-1~deb9u3libssl1.1_1.1.0l-1~deb9u3_armel.deb
Debian10armelopenssl< 1.1.1d-0+deb10u5openssl_1.1.1d-0+deb10u5_armel.deb
Debian9i386libssl1.1-udeb< 1.1.0l-1~deb9u3libssl1.1-udeb_1.1.0l-1~deb9u3_i386.deb
Debian10armhflibcrypto1.1-udeb< 1.1.1d-0+deb10u5libcrypto1.1-udeb_1.1.1d-0+deb10u5_armhf.deb
Debian10s390xopenssl< 1.1.1d-0+deb10u5openssl_1.1.1d-0+deb10u5_s390x.deb
Debian9armhflibssl1.1-udeb< 1.1.0l-1~deb9u3libssl1.1-udeb_1.1.0l-1~deb9u3_armhf.deb
Debian10arm64openssl-dbgsym< 1.1.1d-0+deb10u5openssl-dbgsym_1.1.1d-0+deb10u5_arm64.deb
Debian10mips64ellibssl1.1-udeb< 1.1.1d-0+deb10u5libssl1.1-udeb_1.1.1d-0+deb10u5_mips64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	armel	libssl-dev	< 1.1.1d-0+deb10u5	libssl-dev_1.1.1d-0+deb10u5_armel.deb
Debian	9	i386	libssl-dev	< 1.1.0l-1~deb9u3	libssl-dev_1.1.0l-1~deb9u3_i386.deb
Debian	9	armel	libssl1.1	< 1.1.0l-1~deb9u3	libssl1.1_1.1.0l-1~deb9u3_armel.deb
Debian	10	armel	openssl	< 1.1.1d-0+deb10u5	openssl_1.1.1d-0+deb10u5_armel.deb
Debian	9	i386	libssl1.1-udeb	< 1.1.0l-1~deb9u3	libssl1.1-udeb_1.1.0l-1~deb9u3_i386.deb
Debian	10	armhf	libcrypto1.1-udeb	< 1.1.1d-0+deb10u5	libcrypto1.1-udeb_1.1.1d-0+deb10u5_armhf.deb
Debian	10	s390x	openssl	< 1.1.1d-0+deb10u5	openssl_1.1.1d-0+deb10u5_s390x.deb
Debian	9	armhf	libssl1.1-udeb	< 1.1.0l-1~deb9u3	libssl1.1-udeb_1.1.0l-1~deb9u3_armhf.deb
Debian	10	arm64	openssl-dbgsym	< 1.1.1d-0+deb10u5	openssl-dbgsym_1.1.1d-0+deb10u5_arm64.deb
Debian	10	mips64el	libssl1.1-udeb	< 1.1.1d-0+deb10u5	libssl1.1-udeb_1.1.1d-0+deb10u5_mips64el.deb