Debian update for openssl



| Updated: 2022-05-03
Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-4160
CVE-2022-0778
CWE-ID CWE-310
CWE-835
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
 openssl (Debian package)
Operating systems & Components / Operating system package or component

Vendor Debian

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Cryptographic issues

EUVDB-ID: #VU60166

Risk: Low

CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-4160

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to decrypt TLS traffic.

The vulnerability exists due to BN_mod_exp may produce incorrect results on MIPS. A remote attacker can decrypt TLS traffic. According to vendor, multiple EC algorithms are affected, including some of the TLS 1.3 default curves. 

Successful exploitation of the vulnerability requires certain pre-requisites for attack, such as obtaining and  reusing private keys. 

Mitigation

Update openssl package to one of the following versions: 1.1.1d-0+deb10u8, 1.1.1k-1+deb11u2.

Vulnerable software versions

openssl (Debian package): 1.1.0l - 1.1.1-2

CPE2.3 External links

https://www.debian.org/security/2022/dsa-5103


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Infinite loop

EUVDB-ID: #VU61391

Risk: Medium

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2022-0778

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop within the BN_mod_sqrt() function when processing an ASN.1 certificate that contains elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. A remote attacker can supply a specially crafted certificate to the TLS server or client, consume all available system resources and cause denial of service conditions.

Mitigation

Update openssl package to one of the following versions: 1.1.1d-0+deb10u8, 1.1.1k-1+deb11u2.

Vulnerable software versions

openssl (Debian package): 1.1.0l - 1.1.1-2

CPE2.3 External links

https://www.debian.org/security/2022/dsa-5103


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###