Univention Bugzilla – Bug 52141
openssl1.0: Multiple issues (4.4)
Last modified: 2020-09-30 15:37:49 CEST
New Debian openssl1.0 1.0.2u-1~deb9u2 fixes: This update addresses the following issue: * Information exposure when DH secret are reused across multiple TLS connections (CVE-2020-1968)
--- mirror/ftp/4.4/unmaintained/4.4-4/source/openssl1.0_1.0.2u-1~deb9u1.dsc +++ apt/ucs_4.4-0-errata4.4-6/source/openssl1.0_1.0.2u-1~deb9u2.dsc @@ -1,3 +1,9 @@ +1.0.2u-1~deb9u2 [Fri, 25 Sep 2020 17:14:36 -0400] Roberto C. Sanchez <roberto@debian.org>: + + * Non-maintainer upload by the LTS Team. + * Fix CVE-2020-1968: disable ciphers that reuse the DH secret across + multiple TLS connections in ssl/s3_lib.c. Patch by Marc Deslauriers. + 1.0.2u-1~deb9u1 [Mon, 23 Dec 2019 23:24:17 +0100] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: * Import 1.0.2u <http://10.200.17.11/4.4-6/#5714330615746530700>
OK: yaml OK: announce_errata OK: patch ~OK: piuparts dbgsym [4.4-6] 91dc27789f Bug #52141: openssl1.0 1.0.2u-1~deb9u2 doc/errata/staging/openssl1.0.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x754>