Ubuntu Security Notice 6854-1 - It was discovered that OpenSSL failed to choose an appropriately short private key size when computing shared-secrets in the Diffie-Hellman Key Agreement Protocol. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, resulting in a denial of service.
25be483ab4fe983931a2cd1c71dbddbd45afc6d92c5114b9707eaab0820d5c8f
==========================================================================
Ubuntu Security Notice USN-6854-1
June 27, 2024
openssl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
Summary:
OpenSSL could be made to consume resources and cause long delays if it processed
certain input.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
It was discovered that OpenSSL failed to choose an appropriately short
private key size when computing shared-secrets in the Diffie-Hellman Key
Agreement Protocol. A remote attacker could possibly use this issue to cause
OpenSSL to consume resources, resulting in a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
libssl3 3.0.2-0ubuntu1.16
openssl 3.0.2-0ubuntu1.16
After a standard system update you need to reboot your computer to make all the
necessary changes.
References:
https://ubuntu.com/security/notices/USN-6854-1
CVE-2022-40735
Package Information:
https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.16
--
Alex Murray
Staff Engineer | Security Engineering
Adelaide, Australia (GMT+0930)