USN-6039-1: OpenSSL vulnerabilities

Packages

openssl - Secure Socket Layer (SSL) cryptographic library and tools
openssl1.0 - Secure Socket Layer (SSL) cryptographic library and tools

Details

It was discovered that OpenSSL was not properly managing file locks when
processing policy constraints. If a user or automated system were tricked
into processing a certificate chain with specially crafted policy
constraints, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu
22.10. (CVE-2022-3996)

David Benjamin discovered that OpenSSL was not properly performing the
verification of X.509 certificate chains that include policy constraints,
which could lead to excessive resource consumption. If a user or automated
system were tricked into processing a specially crafted X.509 certificate
chain that includes policy constraints, a remote attacker could possibly
use this issue to cause a denial of service. (CVE-2023-0464)

David Benjamin discovered that OpenSSL was not properly...

It was discovered that OpenSSL was not properly managing file locks when
processing policy constraints. If a user or automated system were tricked
into processing a certificate chain with specially crafted policy
constraints, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu
22.10. (CVE-2022-3996)

David Benjamin discovered that OpenSSL was not properly performing the
verification of X.509 certificate chains that include policy constraints,
which could lead to excessive resource consumption. If a user or automated
system were tricked into processing a specially crafted X.509 certificate
chain that includes policy constraints, a remote attacker could possibly
use this issue to cause a denial of service. (CVE-2023-0464)

David Benjamin discovered that OpenSSL was not properly handling invalid
certificate policies in leaf certificates, which would result in certain
policy checks being skipped for the certificate. If a user or automated
system were tricked into processing a specially crafted certificate, a
remote attacker could possibly use this issue to assert invalid
certificate policies and circumvent policy checking. (CVE-2023-0465)

David Benjamin discovered that OpenSSL incorrectly documented the
functionalities of function X509_VERIFY_PARAM_add0_policy, stating that
it would implicitly enable certificate policy checks when doing
certificate verifications, contrary to its implementation. This could
cause users and applications to not perform certificate policy checks
even when expected to do so. (CVE-2023-0466)

Update instructions

After a standard system update you need to reboot your computer to make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
23.04 lunar	openssl – 3.0.8-1ubuntu1.1
	libssl-doc – 3.0.8-1ubuntu1.1
	libssl3 – 3.0.8-1ubuntu1.1
22.10 kinetic	openssl – 3.0.5-2ubuntu2.2
	libssl-doc – 3.0.5-2ubuntu2.2
	libssl3 – 3.0.5-2ubuntu2.2
22.04 jammy	openssl – 3.0.2-0ubuntu1.9
	libssl-doc – 3.0.2-0ubuntu1.9
	libssl3 – 3.0.2-0ubuntu1.9
20.04 focal	libssl1.1 – 1.1.1f-1ubuntu2.18
	openssl – 1.1.1f-1ubuntu2.18
	libssl-doc – 1.1.1f-1ubuntu2.18
18.04 bionic	libssl1.0.0 – 1.0.2n-1ubuntu5.12
	openssl – 1.1.1-1ubuntu2.1~18.04.22
	libssl-doc – 1.1.1-1ubuntu2.1~18.04.22
	openssl1.0 – 1.0.2n-1ubuntu5.12
	libssl1.1 – 1.1.1-1ubuntu2.1~18.04.22
16.04 xenial	openssl – 1.0.2g-1ubuntu4.20+esm7
	libssl-doc – 1.0.2g-1ubuntu4.20+esm7
	libssl1.0.0 – 1.0.2g-1ubuntu4.20+esm7
14.04 trusty	openssl – 1.0.1f-1ubuntu2.27+esm7
	libssl-doc – 1.0.1f-1ubuntu2.27+esm7
	libssl1.0.0 – 1.0.1f-1ubuntu2.27+esm7

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References