USN-6854-1: OpenSSL vulnerability

Releases

• Ubuntu 22.04 LTS

Packages

• openssl - Secure Socket Layer (SSL) cryptographic library and tools

Details

It was discovered that OpenSSL failed to choose an appropriately short
private key size when computing shared-secrets in the Diffie-Hellman Key
Agreement Protocol. A remote attacker could possibly use this issue to cause
OpenSSL to consume resources, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• libssl3 - 3.0.2-0ubuntu1.16
• openssl - 3.0.2-0ubuntu1.16

After a standard system update you need to reboot your computer to make all the
necessary changes.

References

• CVE-2022-40735