OpenSSL - Multiple Security Issues
Summary
DSA-2833-1: openssl - several. Affects openssl versions < 1.0.1e-2+deb7u1. Fixed in 1.0.1e-2+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is an open-source software library that provides cryptographic functions to secure communications over computer networks. It is widely used in various applications, including web servers, email servers, and virtual private networks (VPNs). The vulnerability in question affects OpenSSL version 1.0.1e-2+deb7u1 on Debian 7 (wheezy) and version 1.0.1e-5 on Debian sid (unstable).
Vulnerability Detail
Multiple security issues have been identified and fixed in OpenSSL. Firstly, the TLS 1.2 support was susceptible to denial of service attacks. Additionally, a vulnerability related to retransmission of DTLS (Datagram Transport Layer Security) messages was addressed. Furthermore, this update disables the insecure Dual_EC_DRBG algorithm, which was unused but posed a potential risk. Lastly, the update ensures that the RdRand feature available on some Intel CPUs is not the sole source of entropy unless explicitly requested.
How To Fix
Minimum fixed version
1.0.1e-2+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Multiple security issues have been addressed in OpenSSL, including vulnerabilities related to TLS 1.2 support, DTLS message retransmission, and the insecure Dual_EC_DRBG algorithm. It is crucial to upgrade to the fixed versions of OpenSSL to mitigate these risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is an open-source software library that provides cryptographic functions for secure communication over computer networks.
The vulnerability affects OpenSSL version 1.0.1e-2+deb7u1 on Debian 7 (wheezy) and version 1.0.1e-5 on Debian sid (unstable).
The vulnerability could lead to denial of service attacks and potential compromise of cryptographic security.
No specific workaround is mentioned in the vulnerability details. It is recommended to upgrade to the fixed versions of OpenSSL.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
