[USN-6039-1] OpenSSL vulnerabilities

[Camila Camargo de Matos]

==========================================================================
Ubuntu Security Notice USN-6039-1
April 25, 2023

openssl, openssl1.0 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.04
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in OpenSSL.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
- openssl1.0: Secure Socket Layer (SSL) cryptographic library and tools

Details:

It was discovered that OpenSSL was not properly managing file locks when
processing policy constraints. If a user or automated system were tricked
into processing a certificate chain with specially crafted policy
constraints, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu
22.10. (CVE-2022-3996)

David Benjamin discovered that OpenSSL was not properly performing the
verification of X.509 certificate chains that include policy constraints,
which could lead to excessive resource consumption. If a user or automated
system were tricked into processing a specially crafted X.509 certificate
chain that includes policy constraints, a remote attacker could possibly
use this issue to cause a denial of service. (CVE-2023-0464)

David Benjamin discovered that OpenSSL was not properly handling invalid
certificate policies in leaf certificates, which would result in certain
policy checks being skipped for the certificate. If a user or automated
system were tricked into processing a specially crafted certificate, a
remote attacker could possibly use this issue to assert invalid
certificate policies and circumvent policy checking. (CVE-2023-0465)

David Benjamin discovered that OpenSSL incorrectly documented the
functionalities of function X509_VERIFY_PARAM_add0_policy, stating that
it would implicitly enable certificate policy checks when doing
certificate verifications, contrary to its implementation. This could
cause users and applications to not perform certificate policy checks
even when expected to do so. (CVE-2023-0466)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.04:
   libssl-doc                      3.0.8-1ubuntu1.1
   libssl3                         3.0.8-1ubuntu1.1
   openssl                         3.0.8-1ubuntu1.1

Ubuntu 22.10:
   libssl-doc                      3.0.5-2ubuntu2.2
   libssl3                         3.0.5-2ubuntu2.2
   openssl                         3.0.5-2ubuntu2.2

Ubuntu 22.04 LTS:
   libssl-doc                      3.0.2-0ubuntu1.9
   libssl3                         3.0.2-0ubuntu1.9
   openssl                         3.0.2-0ubuntu1.9

Ubuntu 20.04 LTS:
   libssl-doc                      1.1.1f-1ubuntu2.18
   libssl1.1                       1.1.1f-1ubuntu2.18
   openssl                         1.1.1f-1ubuntu2.18

Ubuntu 18.04 LTS:
   libssl-doc                      1.1.1-1ubuntu2.1~18.04.22
   libssl1.0.0                     1.0.2n-1ubuntu5.12
   libssl1.1                       1.1.1-1ubuntu2.1~18.04.22
   openssl                         1.1.1-1ubuntu2.1~18.04.22
   openssl1.0                      1.0.2n-1ubuntu5.12

Ubuntu 16.04 ESM:
   libssl-doc                      1.0.2g-1ubuntu4.20+esm7
   libssl1.0.0                     1.0.2g-1ubuntu4.20+esm7
   openssl                         1.0.2g-1ubuntu4.20+esm7

Ubuntu 14.04 ESM:
   libssl-doc                      1.0.1f-1ubuntu2.27+esm7
   libssl1.0.0                     1.0.1f-1ubuntu2.27+esm7
   openssl                         1.0.1f-1ubuntu2.27+esm7

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6039-1
   CVE-2022-3996, CVE-2023-0464, CVE-2023-0466

Package Information:
   https://launchpad.net/ubuntu/+source/openssl/3.0.8-1ubuntu1.1
   https://launchpad.net/ubuntu/+source/openssl/3.0.5-2ubuntu2.2
   https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.9
   https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2.18
https://launchpad.net/ubuntu/+source/openssl/1.1.1-1ubuntu2.1~18.04.22
https://launchpad.net/ubuntu/+source/openssl1.0/1.0.2n-1ubuntu5.12

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20230425/d911b900/attachment-0001.sig>