Format: 1.8
Date: Mon, 06 Feb 2023 12:57:17 -0500
Source: openssl
Binary: libcrypto1.1-udeb libssl-dev libssl1.1 libssl1.1-udeb openssl
Architecture: i386 i386_translations
Version: 1.1.1f-1ubuntu2.17
Distribution: focal
Urgency: medium
Maintainer: Launchpad Build Daemon <buildd@lcy02-amd64-083.buildd>
Changed-By: Marc Deslauriers <marc.deslauriers@ubuntu.com>
Description:
 libcrypto1.1-udeb - Secure Sockets Layer toolkit - libcrypto udeb (udeb)
 libssl-dev - Secure Sockets Layer toolkit - development files
 libssl1.1  - Secure Sockets Layer toolkit - shared libraries
 libssl1.1-udeb - ssl shared library - udeb (udeb)
 openssl    - Secure Sockets Layer toolkit - cryptographic utility
Changes:
 openssl (1.1.1f-1ubuntu2.17) focal-security; urgency=medium
 .
   * SECURITY UPDATE: Timing Oracle in RSA Decryption
     - debian/patches/CVE-2022-4304.patch: fix timing oracle in
       crypto/bn/bn_blind.c, crypto/bn/bn_err.c, crypto/bn/bn_local.h,
       crypto/bn/build.info, crypto/bn/rsa_sup_mul.c,
       crypto/err/openssl.txt, crypto/rsa/rsa_ossl.c, include/crypto/bn.h,
       include/openssl/bnerr.h.
     - CVE-2022-4304
   * SECURITY UPDATE: Double free after calling PEM_read_bio_ex
     - debian/patches/CVE-2022-4450-1.patch: avoid dangling ptrs in header
       and data params for PEM_read_bio_ex in crypto/pem/pem_lib.c.
     - debian/patches/CVE-2022-4450-2.patch: add a test in test/pemtest.c.
     - CVE-2022-4450
   * SECURITY UPDATE: Use-after-free following BIO_new_NDEF
     - debian/patches/CVE-2023-0215-1.patch: fix a UAF resulting from a bug
       in BIO_new_NDEF in crypto/asn1/bio_ndef.c.
     - debian/patches/CVE-2023-0215-2.patch: check CMS failure during BIO
       setup with -stream is handled correctly in
       test/recipes/80-test_cms.t, test/smime-certs/badrsa.pem.
     - CVE-2023-0215
   * SECURITY UPDATE: X.400 address type confusion in X.509 GeneralName
     - debian/patches/CVE-2023-0286.patch: fix GENERAL_NAME_cmp for
       x400Address in crypto/x509/v3_genn.c, include/openssl/x509v3.h,
       test/v3nametest.c.
     - CVE-2023-0286
Checksums-Sha1:
 af0902f33a720977578ff3c03e1e136a5eecbb48 1072424 libcrypto1.1-udeb_1.1.1f-1ubuntu2.17_i386.udeb
 ed03fe3768a52c04646f13d7b71511bafa74ad81 1615596 libssl-dev_1.1.1f-1ubuntu2.17_i386.deb
 533f95b38bf6dd621f2727c50a97afcc87e33288 2385916 libssl1.1-dbgsym_1.1.1f-1ubuntu2.17_i386.ddeb
 c2601f43970275e6b8942ccbe7b786068976c994 206704 libssl1.1-udeb_1.1.1f-1ubuntu2.17_i386.udeb
 5c1ae3a721f0b786762df2e36539dfc97019b7ee 1320092 libssl1.1_1.1.1f-1ubuntu2.17_i386.deb
 48f7244eeb97985d5d6f22eb27fd660bb16dbd4a 492140 openssl-dbgsym_1.1.1f-1ubuntu2.17_i386.ddeb
 76573a74c91aff9cd983a9e95a221cdcf137c684 7367 openssl_1.1.1f-1ubuntu2.17_i386.buildinfo
 fc2cbf2eb764a92cea8919f5774c2056f13d069b 630996 openssl_1.1.1f-1ubuntu2.17_i386.deb
 41c997452dad595e259f00d1fce1539788fc3ffb 27396 openssl_1.1.1f-1ubuntu2.17_i386_translations.tar.gz
Checksums-Sha256:
 13d9f335326f90d05c06d3a5d8ce9fe89b573bcb9f8c3f9f6a26a8077e2fe341 1072424 libcrypto1.1-udeb_1.1.1f-1ubuntu2.17_i386.udeb
 70afe5a93375b2b9baee2371ebd5bb0eb503e33f5e73c82259852cace6a27515 1615596 libssl-dev_1.1.1f-1ubuntu2.17_i386.deb
 3bb3f0f68a8c2e2fefac3a2cd170bb99055a494c50c37c8c5623d31ac97cc79c 2385916 libssl1.1-dbgsym_1.1.1f-1ubuntu2.17_i386.ddeb
 aedd35b6d846d5ed7fa6d4b92edf3c6fce835c86a0156eab1a3d1a75a4766669 206704 libssl1.1-udeb_1.1.1f-1ubuntu2.17_i386.udeb
 095c6c6f013da7be02ee3bbaf91d2b1688ab9339d2d7ac633a6d6115c5fc4fdb 1320092 libssl1.1_1.1.1f-1ubuntu2.17_i386.deb
 65e30196a51b92ffa117a833ed8301e629a720feb5ed2667f3f84be8e607e4da 492140 openssl-dbgsym_1.1.1f-1ubuntu2.17_i386.ddeb
 1eb920ebee16a6c450a187add22be8b6ef60add1f259323159fdaf456a733c2c 7367 openssl_1.1.1f-1ubuntu2.17_i386.buildinfo
 70754e46d48b0436f99bdaf7057a76cc93cf69f454df3e16c57e2bc323d238d2 630996 openssl_1.1.1f-1ubuntu2.17_i386.deb
 e4c1fcf47770885e3ae02cd9412ecb13e74c8b6bb99208ebe473afe53fea758d 27396 openssl_1.1.1f-1ubuntu2.17_i386_translations.tar.gz
Files:
 3eaa1c8322edacd2cd981d612e310082 1072424 debian-installer optional libcrypto1.1-udeb_1.1.1f-1ubuntu2.17_i386.udeb
 8ae10a5f219d92c8c34ac13b33e9b1e1 1615596 libdevel optional libssl-dev_1.1.1f-1ubuntu2.17_i386.deb
 df2121558db59614558db5e676a66256 2385916 debug optional libssl1.1-dbgsym_1.1.1f-1ubuntu2.17_i386.ddeb
 f4aace95cd262f560b33ae132332c94f 206704 debian-installer optional libssl1.1-udeb_1.1.1f-1ubuntu2.17_i386.udeb
 fc414efda36d2c1eb0676dfd207717d5 1320092 libs optional libssl1.1_1.1.1f-1ubuntu2.17_i386.deb
 35ab86d9674516f528b59775659700d6 492140 debug optional openssl-dbgsym_1.1.1f-1ubuntu2.17_i386.ddeb
 b6a0a3972bf7efb21ffd34e6130a0056 7367 utils optional openssl_1.1.1f-1ubuntu2.17_i386.buildinfo
 960c2774addc8abfbfddcf8555608a70 630996 utils optional openssl_1.1.1f-1ubuntu2.17_i386.deb
 90b623f31e723ddc1b6cdd0201cf1efe 27396 raw-translations - openssl_1.1.1f-1ubuntu2.17_i386_translations.tar.gz
Original-Maintainer: Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org>