USN-6039-1: OpenSSL vulnerabilities

Releases

• Ubuntu 23.04
• Ubuntu 22.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM
• Ubuntu 14.04 ESM

Packages

• openssl - Secure Socket Layer (SSL) cryptographic library and tools
• openssl1.0 - Secure Socket Layer (SSL) cryptographic library and tools

Details

It was discovered that OpenSSL was not properly managing file locks when
processing policy constraints. If a user or automated system were tricked
into processing a certificate chain with specially crafted policy
constraints, a remote attacker could possibly use this issue to cause a
denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu
22.10. (CVE-2022-3996)

David Benjamin discovered that OpenSSL was not properly performing the
verification of X.509 certificate chains that include policy constraints,
which could lead to excessive resource consumption. If a user or automated
system were tricked into processing a specially crafted X.509 certificate
chain that includes policy constraints, a remote attacker could possibly
use this issue to cause a denial of service. (CVE-2023-0464)

David Benjamin discovered that OpenSSL was not properly handling invalid
certificate policies in leaf certificates, which would result in certain
policy checks being skipped for the certificate. If a user or automated
system were tricked into processing a specially crafted certificate, a
remote attacker could possibly use this issue to assert invalid
certificate policies and circumvent policy checking. (CVE-2023-0465)

David Benjamin discovered that OpenSSL incorrectly documented the
functionalities of function X509_VERIFY_PARAM_add0_policy, stating that
it would implicitly enable certificate policy checks when doing
certificate verifications, contrary to its implementation. This could
cause users and applications to not perform certificate policy checks
even when expected to do so. (CVE-2023-0466)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• openssl - 3.0.8-1ubuntu1.1
• libssl-doc - 3.0.8-1ubuntu1.1
• libssl3 - 3.0.8-1ubuntu1.1

Ubuntu 22.10

• openssl - 3.0.5-2ubuntu2.2
• libssl-doc - 3.0.5-2ubuntu2.2
• libssl3 - 3.0.5-2ubuntu2.2

Ubuntu 22.04

• openssl - 3.0.2-0ubuntu1.9
• libssl-doc - 3.0.2-0ubuntu1.9
• libssl3 - 3.0.2-0ubuntu1.9

Ubuntu 20.04

• libssl1.1 - 1.1.1f-1ubuntu2.18
• openssl - 1.1.1f-1ubuntu2.18
• libssl-doc - 1.1.1f-1ubuntu2.18

Ubuntu 18.04

• libssl1.0.0 - 1.0.2n-1ubuntu5.12
• openssl - 1.1.1-1ubuntu2.1~18.04.22
• libssl-doc - 1.1.1-1ubuntu2.1~18.04.22
• openssl1.0 - 1.0.2n-1ubuntu5.12
• libssl1.1 - 1.1.1-1ubuntu2.1~18.04.22

Ubuntu 16.04

• openssl - 1.0.2g-1ubuntu4.20+esm7
  Available with Ubuntu Pro
• libssl-doc - 1.0.2g-1ubuntu4.20+esm7
  Available with Ubuntu Pro
• libssl1.0.0 - 1.0.2g-1ubuntu4.20+esm7
  Available with Ubuntu Pro

Ubuntu 14.04

• openssl - 1.0.1f-1ubuntu2.27+esm7
  Available with Ubuntu Pro
• libssl-doc - 1.0.1f-1ubuntu2.27+esm7
  Available with Ubuntu Pro
• libssl1.0.0 - 1.0.1f-1ubuntu2.27+esm7
  Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

• CVE-2022-3996
• CVE-2023-0464
• CVE-2023-0466