Test ID:	1.3.6.1.4.1.25623.1.1.12.2024.6937.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6937-1)
Summary:	The remote host is missing an update for the 'openssl' package(s) announced via the USN-6937-1 advisory.
Description:	Summary: The remote host is missing an update for the 'openssl' package(s) announced via the USN-6937-1 advisory. Vulnerability Insight: It was discovered that OpenSSL incorrectly handled TLSv1.3 sessions when certain non-default TLS server configurations were in use. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, leading to a denial of service. (CVE-2024-2511) It was discovered that OpenSSL incorrectly handled checking excessively long DSA keys or parameters. A remote attacker could possibly use this issue to cause OpenSSL to consume resources, leading to a denial of service. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-4603) William Ahern discovered that OpenSSL incorrectly handled certain memory operations in a rarely-used API. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2024-4741) Joseph Birr-Pixton discovered that OpenSSL incorrectly handled calling a certain API with an empty supported client protocols buffer. A remote attacker could possibly use this issue to obtain sensitive information, or cause OpenSSL to crash, resulting in a denial of service. (CVE-2024-5535) Affected Software/OS: 'openssl' package(s) on Ubuntu 20.04, Ubuntu 22.04, Ubuntu 24.04. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2024-2511 1.1.1y git commit https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640 3.0.14 git commit https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d 3.1.6 git commit https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce 3.2.2 git commit https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08 OpenSSL Advisory https://www.openssl.org/news/secadv/20240408.txt http://www.openwall.com/lists/oss-security/2024/04/08/5 Common Vulnerability Exposure (CVE) ID: CVE-2024-4603 https://github.com/openssl/openssl/commit/3559e868e58005d15c6013a0c1fd832e51c73397 https://github.com/openssl/openssl/commit/9c39b3858091c152f52513c066ff2c5a47969f0d https://github.com/openssl/openssl/commit/da343d0605c826ef197aceedc67e8e04f065f740 3.3.1 git commit https://github.com/openssl/openssl/commit/53ea06486d296b890d565fb971b2764fcd826e7e https://www.openssl.org/news/secadv/20240516.txt http://www.openwall.com/lists/oss-security/2024/05/16/2 Common Vulnerability Exposure (CVE) ID: CVE-2024-4741 Common Vulnerability Exposure (CVE) ID: CVE-2024-5535
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.