OpenSSL: Denial of Service -- Remote/Unauthenticated

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2020.4320
                     USN-4662-1: OpenSSL vulnerability
                              9 December 2020

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           OpenSSL
Publisher:         Ubuntu
Operating System:  Ubuntu
                   Windows
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Denial of Service -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2020-1971  

Original Bulletin: 
   https://ubuntu.com/security/notices/USN-4662-1

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Ubuntu. It is recommended that administrators 
         running OpenSSL check for an updated version of the software for 
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

USN-4662-1: OpenSSL vulnerability
08 December 2020

OpenSSL could be made to crash if it processed specially crafted input.
Releases

  o Ubuntu 20.10
  o Ubuntu 20.04 LTS
  o Ubuntu 18.04 LTS
  o Ubuntu 16.04 LTS

Packages

  o openssl - Secure Socket Layer (SSL) cryptographic library and tools
  o openssl1.0 - Secure Socket Layer (SSL) cryptographic library and tools

Details

David Benjamin discovered that OpenSSL incorrectly handled comparing
certificates containing a EDIPartyName name type. A remote attacker could
possibly use this issue to cause OpenSSL to crash, resulting in a denial of
service.

Update instructions

The problem can be corrected by updating your system to the following package
versions:

Ubuntu 20.10

  o libssl1.1 - 1.1.1f-1ubuntu4.1

Ubuntu 20.04

  o libssl1.1 - 1.1.1f-1ubuntu2.1

Ubuntu 18.04

  o libssl1.0.0 - 1.0.2n-1ubuntu5.5
  o libssl1.1 - 1.1.1-1ubuntu2.1~18.04.7

Ubuntu 16.04

  o libssl1.0.0 - 1.0.2g-1ubuntu4.18

After a standard system update you need to reboot your computer to make all
the necessary changes.

References

  o CVE-2020-1971

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBX9BLTeNLKJtyKPYoAQju9w/9GIIigs5uefwv5uxquhX4EmKx2+5DUVNt
X8PpWtfPAuj7C+y0WwYNq+IE8hschzZwve2S2nObq6eML6MEXcLjmzCIkrwZ8R4I
fVetQZ9NfL/nNAIKOIj96u+/tuUdBiWiP3K7wBTHN43+wLxewQDeyOCwygIBUqM6
7eYJdWSi+TMYmDNzoMfZgD8lAIc+ZhBgMPZSXee3Mgb2obwCm9yIGmMmSBJ7SMmG
1o/7LGguUs3ksVGtYNlo5UaCSgbk4RSuLmVofYmQQ6sikqEnFhIPOvUwgCP/kczi
GdyrpSSNHCvxD9ezsp2xP8FdLU6mhYjJ9XjdD3OHWBiJDIrxAIbesBYoCJ5WEK3G
Xc/93tR5CfyI82iY1ngqwaORTG+DZ13v65CRt5g9X9t1yX28HZIyIb17J1GYs26W
hn3uAd79C63yIv16pLQ/MSQaU1gzqd1DLL1KP/r9xjMX9GRjDnEh1CN8Rkhdw+G6
YficXa3E9ZQGnFJgRmTXM7fnonusRVQgVXUETLrMdfP0QKJzcK1V9K2JzIRokp79
ZXMFFiybpH7K7T+btPo4Q0g2I0Rt7Xilsqfkn38uFnPy72kUiocQ1J4VzqATOe2t
iEIU2jt8xiMsVnQvwsZC8mLkWAa3bJ1Fxb1IvE6HJ0erLqh7xIVS+0pX0OBjG7Yz
iYUEcp/O+pg=
=cV8H
-----END PGP SIGNATURE-----