USN-990-1: OpenSSL vulnerability

21 September 2010

openssl vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 10.04 LTS
  • Ubuntu 9.10
  • Ubuntu 9.04
  • Ubuntu 8.04 LTS
  • Ubuntu 6.06 LTS


Software Description

  • openssl


Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3 protocols. If an attacker could perform a man in the middle attack at the start of a TLS connection, the attacker could inject arbitrary content at the beginning of the user’s session. This update adds backported support for the new RFC5746 renegotiation extension and will use it when both the client and the server support it.

ATTENTION: After applying this update, a patched server will allow both patched and unpatched clients to connect, but unpatched clients will not be able to renegotiate. For more information, please refer to the following:

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 10.04 LTS
libssl0.9.8 - 0.9.8k-7ubuntu8.1
Ubuntu 9.10
libssl0.9.8 - 0.9.8g-16ubuntu3.2
Ubuntu 9.04
libssl0.9.8 - 0.9.8g-15ubuntu3.5
Ubuntu 8.04 LTS
libssl0.9.8 - 0.9.8g-4ubuntu3.10
Ubuntu 6.06 LTS
libssl0.9.8 - 0.9.8a-7ubuntu0.12

To update your system, please follow these instructions:

After a standard system update you need to reboot your computer to make all the necessary changes.