[ubuntu/xenial-security] openssl 1.0.2g-1ubuntu4.16 (Accepted)

[Marc Deslauriers]

openssl (1.0.2g-1ubuntu4.16) xenial-security; urgency=medium

  * SECURITY UPDATE: ECDSA remote timing attack
    - debian/patches/CVE-2019-1547.patch: for ECC parameters with NULL or
      zero cofactor, compute it in crypto/ec/ec.h, crypto/ec/ec_err.c,
      crypto/ec/ec_lib.c.
    - CVE-2019-1547
  * SECURITY UPDATE: rsaz_512_sqr overflow bug on x86_64
    - debian/patches/CVE-2019-1551.patch: fix an overflow bug in
      rsaz_512_sqr in crypto/bn/asm/rsaz-x86_64.pl.
    - CVE-2019-1551
  * SECURITY UPDATE: Padding Oracle issue
    - debian/patches/CVE-2019-1563.patch: fix a padding oracle in
      PKCS7_dataDecode and CMS_decrypt_set1_pkey in crypto/cms/cms_env.c,
      crypto/cms/cms_lcl.h, crypto/cms/cms_smime.c,
      crypto/pkcs7/pk7_doit.c.
    - CVE-2019-1563

Date: 2020-05-27 20:12:44.535188+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/openssl/1.0.2g-1ubuntu4.16
-------------- next part --------------
Sorry, changesfile not available.