Test ID:	1.3.6.1.4.1.25623.1.1.12.2023.6450.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6450-1)
Summary:	The remote host is missing an update for the 'openssl' package(s) announced via the USN-6450-1 advisory.
Description:	Summary: The remote host is missing an update for the 'openssl' package(s) announced via the USN-6450-1 advisory. Vulnerability Insight: Tony Battersby discovered that OpenSSL incorrectly handled key and initialization vector (IV) lengths. This could lead to truncation issues and result in loss of confidentiality for some symmetric cipher modes. (CVE-2023-5363) Juerg Wullschleger discovered that OpenSSL incorrectly handled the AES-SIV cipher. This could lead to empty data entries being ignored, resulting in certain applications being misled. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-2975) It was discovered that OpenSSL incorrectly handled checking excessively long DH keys or parameters. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-3446, CVE-2023-3817) Affected Software/OS: 'openssl' package(s) on Ubuntu 22.04, Ubuntu 23.04, Ubuntu 23.10. Solution: Please install the updated package(s). CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-2975 https://security.gentoo.org/glsa/202402-08 3.0.10 git commit https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=00e2f5eea29994d19293ec4e8c8775ba73678598 3.1.2 git commit https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc OpenSSL Advisory https://www.openssl.org/news/secadv/20230714.txt http://www.openwall.com/lists/oss-security/2023/07/15/1 http://www.openwall.com/lists/oss-security/2023/07/19/5 Common Vulnerability Exposure (CVE) ID: CVE-2023-3446 1.0.2zi patch (premium) https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9a0a4d3c1e7138915563c0df4fe6a3f9377b839c 1.1.1v git commit https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8780a896543a654e757db1b9396383f9d8095528 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1fa20cf2f506113c761777127a38bce5068740eb https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc9867c1e03c22ebf56943be205202e576aabf23 https://www.openssl.org/news/secadv/20230719.txt https://lists.debian.org/debian-lts-announce/2023/08/msg00019.html http://www.openwall.com/lists/oss-security/2023/07/19/4 http://www.openwall.com/lists/oss-security/2023/07/19/6 http://www.openwall.com/lists/oss-security/2023/07/31/1 http://www.openwall.com/lists/oss-security/2024/05/16/1 Common Vulnerability Exposure (CVE) ID: CVE-2023-3817 http://seclists.org/fulldisclosure/2023/Jul/43 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=869ad69aadd985c7b8ca6f4e5dd0eb274c9f3644 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=91ddeba0f2269b017dc06c46c993a788974b1aa5 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9002fd07327a91f35ba6c1307e71fa6fd4409b7f https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=6a1eb62c29db6cb5eec707f9338aee00f44e26f5 https://www.openssl.org/news/secadv/20230731.txt http://www.openwall.com/lists/oss-security/2023/09/22/11 http://www.openwall.com/lists/oss-security/2023/09/22/9 http://www.openwall.com/lists/oss-security/2023/11/06/2 Common Vulnerability Exposure (CVE) ID: CVE-2023-5363 Debian Security Information: DSA-5532 (Google Search) https://www.debian.org/security/2023/dsa-5532 3.0.12 git commit https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0df40630850fb2740e6be6890bb905d3fc623b2d 3.1.4 git commit https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=5f69f5c65e483928c4b28ed16af6e5742929f1ee https://www.openssl.org/news/secadv/20231024.txt http://www.openwall.com/lists/oss-security/2023/10/24/1
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.