USN-7264-1: OpenSSL vulnerabilities

Releases

• Ubuntu 24.10

Packages

• openssl - Secure Socket Layer (SSL) cryptographic library and tools

Details

It was discovered that OpenSSL clients incorrectly handled authenticating
servers using RFC7250 Raw Public Keys. In certain cases, the connection
will not abort as expected, possibly causing the communication to be
intercepted. (CVE-2024-12797)

George Pantelakis and Alicja Kario discovered that OpenSSL had a timing
side-channel when performing ECDSA signature computations. A remote
attacker could possibly use this issue to recover private data.
(CVE-2024-13176)

It was discovered that OpenSSL incorrectly handled certain memory
operations when using low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial. When being used in this uncommon
fashion, a remote attacker could use this issue to cause OpenSSL to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2024-9143)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.10

• libssl3t64 - 3.3.1-2ubuntu2.1
• openssl - 3.3.1-2ubuntu2.1

After a standard system update you need to reboot your computer to make all
the necessary changes.

References

• CVE-2024-12797
• CVE-2024-9143
• CVE-2024-13176