Univention Bugzilla – Bug 52823
openssl1.0: Multiple issues (4.4)
Last modified: 2021-03-17 14:00:00 CET
New Debian openssl1.0 1.0.2u-1~deb9u4 fixes: This update addresses the following issues: * integer overflow in CipherUpdate (CVE-2021-23840) * NULL pointer dereference in X509_issuer_and_serial_hash() (CVE-2021-23841)
--- mirror/ftp/4.4/unmaintained/component/4.4-7-errata/source/openssl1.0_1.0.2u-1~deb9u3.dsc +++ apt/ucs_4.4-0-errata4.4-7/source/openssl1.0_1.0.2u-1~deb9u4.dsc @@ -1,3 +1,11 @@ +1.0.2u-1~deb9u4 [Thu, 18 Feb 2021 18:00:31 +0000] Chris Lamb <lamby@debian.org>: + + * Non-maintainer upload by the LTS team. + * CVE-2021-23840: Prevent an issue where "Digital EnVeloPe" EVP-related calls + could cause applications to behave incorrectly or even crash. + * CVE-2021-23841: Preevent an issue in the X509 certificate handler, caused + by the lack of error handling while parsing "issuer" fields. + 1.0.2u-1~deb9u3 [Fri, 11 Dec 2020 11:42:53 +0100] Emilio Pozuelo Monfort <pochu@debian.org>: * Non-maintainer upload by the LTS team. <http://piuparts.knut.univention.de/4.4-7/#5714330615744365650>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-7] 05552f43a8 Bug #52832: yaml doc/errata/staging/openssl1.0.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) [4.4-7] 820c55b39e Bug #52823: openssl1.0 1.0.2u-1~deb9u4 doc/errata/staging/openssl1.0.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x916>