[Bug 2143932] Re: Rename jitter entropy variables to userspace entropy

[Launchpad Bug Tracker]

This bug was fixed in the package openssl - 3.5.5-1ubuntu3

---------------
openssl (3.5.5-1ubuntu3) resolute; urgency=medium

  * SECURITY UPDATE: OpenSSL TLS 1.3 server may choose unexpected key
    agreement group
    - debian/patches/CVE-2026-2673.patch: fix group tuple handling in
      DEFAULT expansion in doc/man3/SSL_CTX_set1_curves.pod,
      ssl/t1_lib.c, test/tls13groupselection_test.c.
    - CVE-2026-2673
  * SECURITY UPDATE: NULL pointer dereference when processing an OCSP
    response
    - debian/patches/CVE-2026-28387.patch: dane_match_cert() should
      X509_free() on ->mcert instead of OPENSSL_free() in
      crypto/x509/x509_vfy.c.
    - CVE-2026-28387
  * SECURITY UPDATE: NULL Pointer Dereference When Processing a Delta CRL
    - debian/patches/CVE-2026-28388-1.patch: fix NULL Dereference When
      Delta CRL Lacks CRL Number Extension in crypto/x509/x509_vfy.c.
    - debian/patches/CVE-2026-28388-2.patch: Added test in test/*.
    - CVE-2026-28388
  * SECURITY UPDATE: Possible NULL dereference when processing CMS
    KeyAgreeRecipientInfo
    - debian/patches/CVE-2026-28389.patch: Fix NULL deref in
      [ec]dh_cms_set_shared_info in crypto/cms/cms_dh.c,
      crypto/cms/cms_ec.c.
    - CVE-2026-28389
  * SECURITY UPDATE: Possible NULL Dereference When Processing CMS
    KeyTransportRecipientInfo
    - debian/patches/CVE-2026-28390.patch: Fix NULL deref in
      rsa_cms_decrypt in crypto/cms/cms_rsa.c.
    - CVE-2026-28390
  * SECURITY UPDATE: Heap buffer overflow in hexadecimal conversion
    - debian/patches/CVE-2026-31789.patch: avoid possible buffer overflow
      in buf2hex conversion in crypto/o_str.c.
    - CVE-2026-31789
  * SECURITY UPDATE: Incorrect failure handling in RSA KEM RSASVE
    encapsulation
    - debian/patches/CVE-2026-31790-1.patch: validate RSA_public_encrypt()
      result in RSASVE in providers/implementations/kem/rsa_kem.c.
    - debian/patches/CVE-2026-31790-2.patch: test RSA_public_encrypt()
      result in RSASVE in test/evp_extra_test.c.
    - CVE-2026-31790

 -- Marc Deslauriers <marc.deslauriers at ubuntu.com>  Tue, 07 Apr 2026
08:05:56 -0400

** Changed in: openssl (Ubuntu)
       Status: New => Fix Released

** CVE added: https://cve.org/CVERecord?id=CVE-2026-2673

** CVE added: https://cve.org/CVERecord?id=CVE-2026-28387

** CVE added: https://cve.org/CVERecord?id=CVE-2026-28388

** CVE added: https://cve.org/CVERecord?id=CVE-2026-28389

** CVE added: https://cve.org/CVERecord?id=CVE-2026-28390

** CVE added: https://cve.org/CVERecord?id=CVE-2026-31789

** CVE added: https://cve.org/CVERecord?id=CVE-2026-31790

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssl in Ubuntu.
https://bugs.launchpad.net/bugs/2143932

Title:
  Rename jitter entropy variables to userspace entropy

Status in openssl package in Ubuntu:
  Fix Released

Bug description:
  if a kernel is present that is ubuntu distributed and fips enabled,
  OpenSSL should be configured to run using entropy provided by the
  kernel. if there is no kernel present that is fips enabled (eg. in a
  container), OpenSSL should use entropy provided by the userspace
  entropy library.

  Previously it was assumed we would use the jitter entropy library to
  provide userspace entropy. We are discussing using a different
  implementation, so we don't variable names to reflect the something we
  are not using.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/2143932/+subscriptions