[ubuntu/lunar-updates] openssl 3.0.8-1ubuntu1.4 (Accepted)

Ubuntu Archive Robot ubuntu-archive-robot at lists.canonical.com
Tue Oct 24 15:58:38 UTC 2023

openssl (3.0.8-1ubuntu1.4) lunar-security; urgency=medium

  [ Marc Deslauriers ]
  * SECURITY UPDATE: AES-SIV implementation ignores empty associated data
    - debian/patches/CVE-2023-2975.patch: do not ignore empty associated
      data with AES-SIV mode in
    - CVE-2023-2975
  * SECURITY UPDATE: Incorrect cipher key and IV length processing
    - debian/patches/CVE-2023-5363-1.patch: process key length and iv
      length early if present in crypto/evp/evp_enc.c.
    - debian/patches/CVE-2023-5363-2.patch: add unit test in
    - CVE-2023-5363

  [ Ian Constantin ]
  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2023-3446.patch: adds check to prevent the testing of
      an excessively large modulus in DH_check().
    - CVE-2023-3446
  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2023-3817.patch: adds check to prevent the testing of
      invalid q values in DH_check().
    - CVE-2023-3817

Date: 2023-10-16 11:56:15.344357+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
-------------- next part --------------
Sorry, changesfile not available.

More information about the lunar-changes mailing list