OpenSSL - Security Update
Summary
DSA-2908-1: openssl - security update. Affects openssl versions < 1.0.1e-2+deb7u7. Fixed in 1.0.1e-2+deb7u7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is an open-source software library that provides cryptographic functions to secure communications over computer networks. It is widely used in various applications, including web servers, email servers, and virtual private networks (VPNs). OpenSSL is vulnerable to multiple security issues, including a use-after-free vulnerability (CVE-2010-5298) that can be exploited to inject data from one connection into another or cause denial of service. Another vulnerability (CVE-2014-0076) allows for the recovery of ECDSA nonces through a cache side-channel attack. Additionally, there is a missing detection of the critical flag for the TSA extended key usage under certain cases.
Vulnerability Detail
The use-after-free vulnerability (CVE-2010-5298) in OpenSSL occurs when a read buffer is freed even though it still contains data that is used later on. In a multi-threaded application with a race condition, an attacker can exploit this vulnerability to inject data from one connection into another or cause denial of service. The recovery of ECDSA nonces (CVE-2014-0076) is possible through the Yarom/Benger FLUSH+RELOAD cache side-channel attack. This vulnerability can be used to extract sensitive information from the cryptographic operations performed by OpenSSL. The missing detection of the critical flag for the TSA extended key usage can lead to incorrect validation of certificates, potentially undermining the security of the system.
How To Fix
Minimum fixed version
1.0.1e-2+deb7u7
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. The recommended approach is to apply the security updates provided by the OpenSSL project.
Conclusion
OpenSSL is a widely used cryptographic library that has been found to have multiple vulnerabilities, including a use-after-free vulnerability and a cache side-channel attack vulnerability. To mitigate the risk, it is crucial to update the OpenSSL packages to the patched versions as soon as possible. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is an open-source software library that provides cryptographic functions to secure communications over computer networks.
A use-after-free vulnerability occurs when a program frees a memory object that is still being referenced and used. This can lead to various security issues, including data corruption and code execution.
A cache side-channel attack is a type of attack that exploits the information leaked through the cache behavior of a system. By monitoring cache access patterns, an attacker can infer sensitive information, such as cryptographic keys.
The use-after-free vulnerability can be exploited by an attacker in a multi-threaded application with a race condition. By injecting data from one connection into another, the attacker can manipulate the behavior of the application or cause denial of service. The recovery of ECDSA nonces through the cache side-channel attack allows an attacker to extract sensitive information from the cryptographic operations performed by OpenSSL.
The recommended mitigation is to update the OpenSSL packages to the patched versions provided by the project. This will address the vulnerabilities and reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
