Summary
Matt Caswell discovered that OpenSSL incorrectly handled certain ASN.1
object identifiers. A remote attacker could possibly use this issue to
cause OpenSSL to consume resources, resulting in a denial of service.
(CVE-2023-2650)
Anton Romanov discovered that OpenSSL incorrectly handled AES-XTS cipher
decryption on 64-bit ARM platforms. An attacker could possibly use this
issue to cause OpenSSL to crash, resulting in a denial of service. This
issue only affected Ubuntu 22.04 LTS, Ubuntu 22.10, and Ubuntu 23.04.
(CVE-2023-1255)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | openssl | 1.1.1-1ubuntu2.1~18.04.23 |
| Ubuntu · 18.04 LTS 18.04:LTS | openssl1.0 | 1.0.2n-1ubuntu5.13 |
| Ubuntu · 20.04 LTS 20.04:LTS | openssl | 1.1.1f-1ubuntu2.19 |
| Ubuntu · 22.04 LTS 22.04:LTS | openssl | 3.0.2-0ubuntu1.10 |
Vulnerabilities 2
-
Medium 6.5CVE-2023-2650 EPSS 75%
Possible DoS translating ASN.1 object identifiers
Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …
-
Medium 5.9
Input buffer over-read in AES-XTS implementation on 64 bit ARM
Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform ca…