OpenSSL - Security Update
Summary
DSA-3500-1: openssl - security update. Affects openssl versions < 1.0.1e-2+deb7u20. Fixed in 1.0.1e-2+deb7u20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a Secure Socket Layer (SSL) toolkit that provides cryptographic functions to secure communications over computer networks. It is widely used in various applications, including web servers, email servers, and virtual private networks (VPNs). OpenSSL is vulnerable to several security issues that could potentially lead to the disclosure of sensitive information, denial of service, or memory corruption.
Vulnerability Detail
The vulnerabilities discovered in OpenSSL include:
-
CVE-2016-0702: A side-channel attack that exploits cache-bank conflicts on the Intel Sandy-Bridge microarchitecture, allowing local attackers to recover RSA private keys.
-
CVE-2016-0705: A double free bug when parsing malformed DSA private keys, which can lead to a denial of service or memory corruption.
-
CVE-2016-0797: An integer overflow in the BN_hex2bn and BN_dec2bn functions, resulting in a NULL pointer dereference and heap corruption. This can lead to a denial of service or memory corruption.
-
CVE-2016-0798: A memory leak in the SRP database lookup code, which can be mitigated by disabling the seed handling in SRP_VBASE_get_by_user.
-
CVE-2016-0799 and CVE-2016-2842: An integer overflow in the BIO_*printf functions, leading to an out-of-bounds read when printing long strings. This can result in a denial of service or memory corruption.
Additionally, the EXPORT and LOW ciphers were disabled to prevent potential attacks such as DROWN and SLOTH.
How To Fix
Minimum fixed version
1.0.1e-2+deb7u20
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
OpenSSL is prone to multiple vulnerabilities that could have serious security implications. It is crucial to update the OpenSSL packages to the recommended versions to mitigate these risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is a Secure Socket Layer (SSL) toolkit that provides cryptographic functions to secure communications over computer networks.
The vulnerabilities in OpenSSL include side-channel attacks, double free bugs, integer overflows, memory leaks, and out-of-bounds reads.
These vulnerabilities could lead to the disclosure of sensitive information, denial of service, or memory corruption in applications using OpenSSL.
To fix these vulnerabilities, you should upgrade the OpenSSL packages to the recommended versions for your Debian distribution.
No specific workarounds are mentioned for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
