[ubuntu/bionic-security] openssl 1.1.1-1ubuntu2.1~18.04.23 (Accepted)

[Marc Deslauriers]

openssl (1.1.1-1ubuntu2.1~18.04.23) bionic-security; urgency=medium

  * SECURITY UPDATE: Possible DoS translating ASN.1 object identifiers
    - debian/patches/CVE-2023-2650.patch: restrict the size of OBJECT
      IDENTIFIERs that OBJ_obj2txt will translate in
      crypto/objects/obj_dat.c.
    - CVE-2023-2650
  * Replace CVE-2022-4304 fix with improved version
    - debian/patches/CVE-2022-4304.patch: remove previous fix.
    - debian/patches/CVE-2022-4304-1.patch: use alternative fix in
      crypto/bn/bn_asm.c, crypto/bn/bn_blind.c, crypto/bn/bn_lib.c,
      crypto/bn/bn_lcl.h, crypto/rsa/rsa_ossl.c.
    - debian/patches/CVE-2022-4304-2.patch: re-add
      BN_F_OSSL_BN_RSA_DO_UNBLIND which was incorrectly removed in
      include/openssl/bnerr.h.

Date: 2023-05-25 12:07:10.306090+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/openssl/1.1.1-1ubuntu2.1~18.04.23
-------------- next part --------------
Sorry, changesfile not available.