[ubuntu/focal-security] openssl 1.1.1f-1ubuntu2.24 (Accepted)

[Marc Deslauriers]

openssl (1.1.1f-1ubuntu2.24) focal-security; urgency=medium

  * SECURITY UPDATE: Low-level invalid GF(2^m) parameters lead to OOB
    memory access
    - debian/patches/CVE-2024-9143.patch: harden BN_GF2m_poly2arr against
      misuse in crypto/bn/bn_gf2m.c, test/ec_internal_test.c.
    - CVE-2024-9143
  * SECURITY UPDATE: A timing side-channel which could potentially allow
    recovering the private key exists in the ECDSA signature computation
    - debian/patches/CVE-2024-13176.patch: Fix timing side-channel in
      ECDSA signature computation in crypto/bn/bn_exp.c,
      crypto/ec/ec_lib.c, include/crypto/bn.h.
    - CVE-2024-13176

Date: 2025-02-05 18:13:11.224626+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2.24
-------------- next part --------------
Sorry, changesfile not available.