Format: 1.8
Date: Mon, 06 Feb 2023 12:57:17 -0500
Source: openssl
Binary: libcrypto1.1-udeb libssl-dev libssl-doc libssl1.1 libssl1.1-udeb openssl
Architecture: amd64 all amd64_translations
Version: 1.1.1f-1ubuntu2.17
Distribution: focal
Urgency: medium
Maintainer: Launchpad Build Daemon <buildd@lcy02-amd64-035.buildd>
Changed-By: Marc Deslauriers <marc.deslauriers@ubuntu.com>
Description:
 libcrypto1.1-udeb - Secure Sockets Layer toolkit - libcrypto udeb (udeb)
 libssl-dev - Secure Sockets Layer toolkit - development files
 libssl-doc - Secure Sockets Layer toolkit - development documentation
 libssl1.1  - Secure Sockets Layer toolkit - shared libraries
 libssl1.1-udeb - ssl shared library - udeb (udeb)
 openssl    - Secure Sockets Layer toolkit - cryptographic utility
Changes:
 openssl (1.1.1f-1ubuntu2.17) focal-security; urgency=medium
 .
   * SECURITY UPDATE: Timing Oracle in RSA Decryption
     - debian/patches/CVE-2022-4304.patch: fix timing oracle in
       crypto/bn/bn_blind.c, crypto/bn/bn_err.c, crypto/bn/bn_local.h,
       crypto/bn/build.info, crypto/bn/rsa_sup_mul.c,
       crypto/err/openssl.txt, crypto/rsa/rsa_ossl.c, include/crypto/bn.h,
       include/openssl/bnerr.h.
     - CVE-2022-4304
   * SECURITY UPDATE: Double free after calling PEM_read_bio_ex
     - debian/patches/CVE-2022-4450-1.patch: avoid dangling ptrs in header
       and data params for PEM_read_bio_ex in crypto/pem/pem_lib.c.
     - debian/patches/CVE-2022-4450-2.patch: add a test in test/pemtest.c.
     - CVE-2022-4450
   * SECURITY UPDATE: Use-after-free following BIO_new_NDEF
     - debian/patches/CVE-2023-0215-1.patch: fix a UAF resulting from a bug
       in BIO_new_NDEF in crypto/asn1/bio_ndef.c.
     - debian/patches/CVE-2023-0215-2.patch: check CMS failure during BIO
       setup with -stream is handled correctly in
       test/recipes/80-test_cms.t, test/smime-certs/badrsa.pem.
     - CVE-2023-0215
   * SECURITY UPDATE: X.400 address type confusion in X.509 GeneralName
     - debian/patches/CVE-2023-0286.patch: fix GENERAL_NAME_cmp for
       x400Address in crypto/x509/v3_genn.c, include/openssl/x509v3.h,
       test/v3nametest.c.
     - CVE-2023-0286
Checksums-Sha1:
 eadd1496a05c2208989154109e57aa30cb405ecb 1090532 libcrypto1.1-udeb_1.1.1f-1ubuntu2.17_amd64.udeb
 22b22baa39cabcddc8ea3d8c7bb50456ad3a0a97 1585240 libssl-dev_1.1.1f-1ubuntu2.17_amd64.deb
 5f4f132946fbfe57abe7836b9ad9b80946f1018e 1525296 libssl-doc_1.1.1f-1ubuntu2.17_all.deb
 c4c3e6102a7fe6d1351ca01d9498d02ad7c00514 3039340 libssl1.1-dbgsym_1.1.1f-1ubuntu2.17_amd64.ddeb
 d265af1e96161893faceb3b829a18ee698d813f0 190824 libssl1.1-udeb_1.1.1f-1ubuntu2.17_amd64.udeb
 aab3ec816b03e4552d7e86634791e91c1e9efec2 1321988 libssl1.1_1.1.1f-1ubuntu2.17_amd64.deb
 0407dc30c75173707272cbb425871663441eccad 552720 openssl-dbgsym_1.1.1f-1ubuntu2.17_amd64.ddeb
 944072c52eb96027f625bad6c22acb5cdb3f5620 7753 openssl_1.1.1f-1ubuntu2.17_amd64.buildinfo
 5bed5f07e2109f8a3460ea09cd753cb933368df5 621792 openssl_1.1.1f-1ubuntu2.17_amd64.deb
 51ee4c6c21b66758d0fcc9340ceca069d39ce954 27397 openssl_1.1.1f-1ubuntu2.17_amd64_translations.tar.gz
Checksums-Sha256:
 373f553781fef8e6133e4b226424169e840b611c3cc5d88317b3c779f6c4c0c9 1090532 libcrypto1.1-udeb_1.1.1f-1ubuntu2.17_amd64.udeb
 ef642b612e37dde61b376af2e31761b8ba89c57a9702aff05e7138952f9c7413 1585240 libssl-dev_1.1.1f-1ubuntu2.17_amd64.deb
 0974d867b9f02cd72c40e275313ba73dddd1bf66f3a9cf4ee4aeb710b3888760 1525296 libssl-doc_1.1.1f-1ubuntu2.17_all.deb
 ca9930c65db5082f99550aa180266af89b889920bd11f6e18140f0ec6e220c74 3039340 libssl1.1-dbgsym_1.1.1f-1ubuntu2.17_amd64.ddeb
 9aaaef7f42c253f7c51bed9466ee8a7c21364d89ac3523f02ff2665b4878fc0d 190824 libssl1.1-udeb_1.1.1f-1ubuntu2.17_amd64.udeb
 a74ccc29b5ac5cde36f00eb2a6a621e1240cd150cbbecedfecd6925b66bdafa0 1321988 libssl1.1_1.1.1f-1ubuntu2.17_amd64.deb
 1ca980308483678c077e184ce84138d323d79817b73707efa2a16d15d48dfc92 552720 openssl-dbgsym_1.1.1f-1ubuntu2.17_amd64.ddeb
 a3267b846d17379ebf4d7eaf48ea096083e80eef5746af6bc18855d16856fea9 7753 openssl_1.1.1f-1ubuntu2.17_amd64.buildinfo
 d5ac4f93fa81c6309fbbe8119e1e02d54927bc94242f2728581882782d9175ba 621792 openssl_1.1.1f-1ubuntu2.17_amd64.deb
 4b62a1d7d04b5f8b398d9137bf3fd6344c447e3150a76e25d24d4708588f7def 27397 openssl_1.1.1f-1ubuntu2.17_amd64_translations.tar.gz
Files:
 d86c2067c0c67fee51007f2434fb2214 1090532 debian-installer optional libcrypto1.1-udeb_1.1.1f-1ubuntu2.17_amd64.udeb
 286c4ab30384d746f7871b07ee32b124 1585240 libdevel optional libssl-dev_1.1.1f-1ubuntu2.17_amd64.deb
 85c34829dfe7d685046e60f10d488c05 1525296 doc optional libssl-doc_1.1.1f-1ubuntu2.17_all.deb
 819bc5d658c63d07a79d99e8b971bf17 3039340 debug optional libssl1.1-dbgsym_1.1.1f-1ubuntu2.17_amd64.ddeb
 1d1bdd705df8843cf03f44737811dda2 190824 debian-installer optional libssl1.1-udeb_1.1.1f-1ubuntu2.17_amd64.udeb
 a2dba9334d24e71dd71c115709f986df 1321988 libs optional libssl1.1_1.1.1f-1ubuntu2.17_amd64.deb
 c658dfc982a963928d9fdc6fdcc0ddea 552720 debug optional openssl-dbgsym_1.1.1f-1ubuntu2.17_amd64.ddeb
 6632d0b418a20f00a60191bb77820c38 7753 utils optional openssl_1.1.1f-1ubuntu2.17_amd64.buildinfo
 85d81527301a4ee9a9b5bf6bc613f882 621792 utils optional openssl_1.1.1f-1ubuntu2.17_amd64.deb
 658d7bb95998ee87090b6d134011ddb4 27397 raw-translations - openssl_1.1.1f-1ubuntu2.17_amd64_translations.tar.gz
Original-Maintainer: Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org>