USN-7278-1: OpenSSL vulnerabilities

USN-7278-1: OpenSSL vulnerabilities
20 February 2025

Several security issues were fixed in OpenSSL.

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages
openssl - Secure Socket Layer (SSL) cryptographic library and tools

Details
George Pantelakis and Alicja Kario discovered that OpenSSL had a timing
side-channel when performing ECDSA signature computations. A remote
attacker could possibly use this issue to recover private data.
(CVE-2024-13176)

It was discovered that OpenSSL incorrectly handled certain memory
operations when using low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial. When being used in this uncommon
fashion, a remote attacker could use this issue to cause OpenSSL to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2024-9143)

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• libssl3t64 - 3.0.13-0ubuntu3.5
• openssl - 3.0.13-0ubuntu3.5
  Ubuntu 22.04
• libssl3 - 3.0.2-0ubuntu1.19
• openssl - 3.0.2-0ubuntu1.19
  Ubuntu 20.04
• libssl1.1 - 1.1.1f-1ubuntu2.24
• openssl - 1.1.1f-1ubuntu2.24
  After a standard system update you need to reboot your computer to make all
  the necessary changes.