Univention Bugzilla – Bug 50350
openssl: Multiple issues (4.3)
Last modified: 2019-10-16 17:18:13 CEST
New Debian openssl 1.1.0l-1~deb9u1 fixes: This update addresses the following issues: * side-channel weak encryption vulnerability (CVE-2019-1547) * information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey (CVE-2019-1563)
--- mirror/ftp/4.3/unmaintained/component/4.3-4-errata/source/openssl_1.1.0k-1~deb9u1.dsc +++ apt/ucs_4.3-0-ucs4.3-5/source/openssl_1.1.0l-1~deb9u1.dsc @@ -1,5 +1,14 @@ -1.1.0k-1~deb9u1 [Wed, 26 Jun 2019 18:59:20 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: +1.1.0l-1~deb9u1 [Fri, 27 Sep 2019 21:46:29 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: + + * Import 1.1.0l + - CVE-2019-1547 (Compute ECC cofactors if not provided during EC_GROUP + construction). + - CVE-2019-1563 (Fixed a padding oracle in PKCS7_dataDecode and + CMS_decrypt_set1_pkey). + +1.1.0k-1~deb9u1 [Wed, 26 Jun 2019 19:41:14 +0200] Sebastian Andrzej Siewior <sebastian@breakpoint.cc>: * Import 1.1.0k - CVE-2019-1543 (Prevent over long nonces in ChaCha20-Poly1305) + * Perform the indep-install step with -j1 to avoid a race in the Makefile. <http://10.200.17.11/4.3-4/#6118916832769105863>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.3-4] d9a08ea3c1 Bug #50350: openssl 1.1.0l-1~deb9u1 doc/errata/staging/openssl.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) [4.3-4] 2e48fbdf5a Bug #50350: openssl_1.1.0l-1~deb9u1 doc/errata/staging/openssl.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
<http://errata.software-univention.de/ucs/4.3/597.html>