Univention Bugzilla – Bug 52826
openssl: Multiple issues (4.4)
Last modified: 2021-03-17 14:00:02 CET
New Debian openssl 1.1.0l-1~deb9u3 fixes: This update addresses the following issues: * integer overflow in CipherUpdate (CVE-2021-23840) * NULL pointer dereference in X509_issuer_and_serial_hash() (CVE-2021-23841)
--- mirror/ftp/4.4/unmaintained/component/4.4-7-errata/source/openssl_1.1.0l-1~deb9u2.dsc +++ apt/ucs_4.4-0-errata4.4-7/source/openssl_1.1.0l-1~deb9u3.dsc @@ -1,3 +1,10 @@ +1.1.0l-1~deb9u3 [Thu, 18 Feb 2021 12:01:14 +0000] Chris Lamb <lamby@debian.org>: + + * CVE-2021-23840: Prevent an issue where "Digital EnVeloPe" EVP-related calls + could cause applications to behave incorrectly or crash. + * CVE-2021-23841: Preevent an issue in the X509 certificate handler caused by + the lack of error handling while parsing the "issuer" field. + 1.1.0l-1~deb9u2 [Fri, 11 Dec 2020 10:22:58 +0100] Emilio Pozuelo Monfort <pochu@debian.org>: * Non-maintainer upload by the LTS team. <http://10.200.17.11/4.4-7/#6118916832771270913>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-7] 739fa68c95 Bug #52826: openssl 1.1.0l-1~deb9u3 doc/errata/staging/openssl.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
<https://errata.software-univention.de/#/?erratum=4.4x915>