Ubuntu
openssl package

openssl 3.0.2-0ubuntu1.17 source package in Ubuntu

Changelog

openssl (3.0.2-0ubuntu1.17) jammy-security; urgency=medium

  * SECURITY UPDATE: unbounded mem growth when processing TLSv1.3 sessions
    - debian/patches/CVE-2024-2511.patch: fix unconstrained session cache
      growth in TLSv1.3 in ssl/ssl_lib.c, ssl/ssl_sess.c,
      ssl/statem/statem_srvr.c.
    - CVE-2024-2511
  * SECURITY UPDATE: checking excessively long DSA keys or params very slow
    - debian/patches/CVE-2024-4603.patch: check DSA parameters for
      excessive sizes before validating in crypto/dsa/dsa_check.c,
      test/recipes/15-test_dsaparam_data/invalid/p10240_q256_too_big.pem.
    - CVE-2024-4603
  * SECURITY UPDATE: use after free with SSL_free_buffers
    - debian/patches/CVE-2024-4741.patch: only free the read buffers if
      we're not using them in ssl/record/rec_layer_s3.c,
      ssl/record/record.h, ssl/ssl_lib.c.
    - CVE-2024-4741
  * SECURITY UPDATE: crash or memory disclosure via SSL_select_next_proto
    - debian/patches/CVE-2024-5535.patch: validate provided client list in
      ssl/ssl_lib.c.
    - CVE-2024-5535

 -- Marc Deslauriers <email address hidden>  Tue, 30 Jul 2024 11:18:05 -0400

Upload details

Uploaded by:
Marc Deslauriers
Uploaded to:
Jammy
Original maintainer:
Ubuntu Developers
Architectures:
any all
Section:
utils
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section

Downloads

File Size SHA-256 Checksum
openssl_3.0.2.orig.tar.gz 14.3 MiB 98e91ccead4d4756ae3c9cde5e09191a8e586d9f4d50838e7ec09d6411dfdb63
openssl_3.0.2.orig.tar.gz.asc 488 bytes 764d220aaa6d5e9c13b4239b61f3b8de57aa53fa8362f56ceeada0a10264a8f1
openssl_3.0.2-0ubuntu1.17.debian.tar.xz 253.7 KiB a73bacd6a023c823b0ffecb68cc4a31a35d63f5153d67be2a2669e6cbfa42604
openssl_3.0.2-0ubuntu1.17.dsc 2.7 KiB bdad1bc9646c91a372006f6c9eb91cec9564ac66221c84ad7f2c0ff2de320b38

View changes file

Binary packages built by this source

libssl-dev: Secure Sockets Layer toolkit - development files

 This package is part of the OpenSSL project's implementation of the SSL
 and TLS cryptographic protocols for secure communication over the
 Internet.
 .
 It contains development libraries, header files, and manpages for libssl
 and libcrypto.

libssl-doc: Secure Sockets Layer toolkit - development documentation

 This package is part of the OpenSSL project's implementation of the SSL
 and TLS cryptographic protocols for secure communication over the
 Internet.
 .
 It contains manpages and demo files for libssl and libcrypto.

libssl3: Secure Sockets Layer toolkit - shared libraries

 This package is part of the OpenSSL project's implementation of the SSL
 and TLS cryptographic protocols for secure communication over the
 Internet.
 .
 It provides the libssl and libcrypto shared libraries.

libssl3-dbgsym: debug symbols for libssl3
openssl: Secure Sockets Layer toolkit - cryptographic utility

 This package is part of the OpenSSL project's implementation of the SSL
 and TLS cryptographic protocols for secure communication over the
 Internet.
 .
 It contains the general-purpose command line binary /usr/bin/openssl,
 useful for cryptographic operations such as:
  * creating RSA, DH, and DSA key parameters;
  * creating X.509 certificates, CSRs, and CRLs;
  * calculating message digests;
  * encrypting and decrypting with ciphers;
  * testing SSL/TLS clients and servers;
  * handling S/MIME signed or encrypted mail.

openssl-dbgsym: debug symbols for openssl