OpenSSL - Security Update (DLA-456-1)
Summary
DLA-456-1: openssl - security update. Affects openssl versions < 1.0.1e-2+deb7u21. Fixed in 1.0.1e-2+deb7u21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a Secure Socket Layer (SSL) toolkit that provides cryptographic functions to secure communications over a computer network. It is widely used in various applications, including web servers, email servers, and VPNs. OpenSSL is vulnerable to multiple security issues that could potentially lead to heap corruption, padding oracle attacks, out-of-bounds writes, and memory exhaustion.
Vulnerability Detail
The vulnerabilities discovered in OpenSSL include:
-
CVE-2016-2105: An overflow in the EVP_EncodeUpdate() function used for Base64 encoding, which can be exploited by supplying a large amount of data, leading to heap corruption.
-
CVE-2016-2106: An overflow in the EVP_EncryptUpdate() function, which can be triggered by supplying a large amount of data, resulting in heap corruption.
-
CVE-2016-2107: A padding oracle vulnerability in the AES CBC cipher implementation based on the AES-NI instruction set, allowing an attacker to decrypt TLS traffic encrypted with certain cipher suites.
-
CVE-2016-2108: Two separate bugs in the ASN.1 encoder, related to handling negative zero integer values and large universal tags, leading to an out-of-bounds write.
-
CVE-2016-2109: A vulnerability that can cause excessive resource consumption or memory exhaustion when reading ASN.1 data from a BIO.
-
CVE-2016-2176: An overread issue in the X509_NAME_oneline() function on EBCDIC systems, which can result in arbitrary stack data being returned in the buffer when processing ASN.1 Strings over 1024 bytes.
How To Fix
Minimum fixed version
1.0.1e-2+deb7u21
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
OpenSSL is vulnerable to multiple security issues that could have serious consequences. It is crucial to update OpenSSL to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is a widely used Secure Socket Layer (SSL) toolkit that provides cryptographic functions for securing network communications.
These vulnerabilities could lead to heap corruption, padding oracle attacks, out-of-bounds writes, and memory exhaustion. Exploiting these vulnerabilities could allow an attacker to decrypt TLS traffic, perform arbitrary code execution, or cause denial-of-service.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by these vulnerabilities. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
No specific workarounds have been mentioned for these vulnerabilities. It is recommended to update OpenSSL to the latest version.
You can find additional information about these vulnerabilities in the OpenSSL security advisory at https://www.openssl.org/news/secadv/20160503.txt.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
