New Debian openssl 1.1.0j-1~deb9u1 fixes: This update addresses the following issues: * Malicious server can send large prime to client during DH(E) TLS handshake causing the client to hang (CVE-2018-0732) * timing side channel attack in the DSA signature algorithm (CVE-2018-0734) * timing side channel attack in ECDSA signature generation (CVE-2018-0735) * RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys (CVE-2018-0737) * Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407)
--- mirror/ftp/4.3/unmaintained/4.3-1/source/openssl_1.1.0f-3+deb9u2.dsc +++ apt/ucs_4.3-0-errata4.3-2/source/openssl_1.1.0j-1~deb9u1.dsc @@ -1,3 +1,21 @@ +1.1.0j-1~deb9u1 [Wed, 28 Nov 2018 23:43:08 +0100] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: + + * Import 1.1.0j + - CVE-2018-0734 (Timing vulnerability in DSA signature generation) + - CVE-2018-0735 (Timing vulnerability in ECDSA signature generation) + - add new symbols + +1.1.0i-1~deb9u1 [Mon, 03 Sep 2018 23:59:02 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: + + * Import 1.1.0i + - Fix segfault ERR_clear_error (Closes: #903566) + - Fix commandline option for CAengine (Closes: #907457) + - CVE-2018-0732 (Client DoS due to large DH parameter) + - CVE-2018-0737 (Cache timing vulnerability in RSA Key Generation) + * Abort the build if symbols are discovered which are not part of the + symbols file. + * use signing-key.asc and a https links for downloads + 1.1.0f-3+deb9u2 [Thu, 29 Mar 2018 12:51:02 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: * CVE-2017-3738 (rsaz_1024_mul_avx2 overflow bug on x86_64) <http://10.200.17.11/4.3-2/#4350801565178550177>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.3-2] e93998f031 Bug #48292: openssl 1.1.0j-1~deb9u1 doc/errata/staging/openssl.yaml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+)
<http://errata.software-univention.de/ucs/4.3/377.html>