[ubuntu/bionic-updates] openssl1.0 1.0.2n-1ubuntu5.4 (Accepted)

[Ubuntu Archive Robot]

openssl1.0 (1.0.2n-1ubuntu5.4) bionic-security; urgency=medium

  * SECURITY UPDATE: Raccoon Attack
    - debian/patches/CVE-2020-1968.patch: disable ciphers that reuse the
      DH secret across multiple TLS connections in ssl/s3_lib.c.
    - CVE-2020-1968
  * SECURITY UPDATE: ECDSA remote timing attack
    - debian/patches/CVE-2019-1547.patch: for ECC parameters with NULL or
      zero cofactor, compute it in crypto/ec/ec.h, crypto/ec/ec_err.c,
      crypto/ec/ec_lib.c.
    - CVE-2019-1547
  * SECURITY UPDATE: rsaz_512_sqr overflow bug on x86_64
    - debian/patches/CVE-2019-1551.patch: fix an overflow bug in
      rsaz_512_sqr in crypto/bn/asm/rsaz-x86_64.pl.
    - CVE-2019-1551
  * SECURITY UPDATE: Padding Oracle issue
    - debian/patches/CVE-2019-1563.patch: fix a padding oracle in
      PKCS7_dataDecode and CMS_decrypt_set1_pkey in crypto/cms/cms_env.c,
      crypto/cms/cms_lcl.h, crypto/cms/cms_smime.c,
      crypto/pkcs7/pk7_doit.c.
    - CVE-2019-1563

Date: 2020-09-16 12:46:15.115616+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <cjwatson+ubuntu-archive-robot at chiark.greenend.org.uk>
https://launchpad.net/ubuntu/+source/openssl1.0/1.0.2n-1ubuntu5.4
-------------- next part --------------
Sorry, changesfile not available.