UBUNTU-CVE-2019-1551

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2019-1551
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-1551.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-1551
Related
Published
2019-12-06T18:15:00Z
Modified
2019-12-06T18:15:00Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
[none]
Details

There is an overflow bug in the x6464 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BNmodexp may be affected if they use BNFLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).

References

Affected packages

Ubuntu:16.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.0.2g-1ubuntu4.16?arch=src?distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.2g-1ubuntu4.16

Affected versions

1.*

1.0.2d-0ubuntu1
1.0.2d-0ubuntu2
1.0.2e-1ubuntu1
1.0.2f-2ubuntu1
1.0.2g-1ubuntu2
1.0.2g-1ubuntu3
1.0.2g-1ubuntu4
1.0.2g-1ubuntu4.1
1.0.2g-1ubuntu4.2
1.0.2g-1ubuntu4.4
1.0.2g-1ubuntu4.5
1.0.2g-1ubuntu4.6
1.0.2g-1ubuntu4.8
1.0.2g-1ubuntu4.9
1.0.2g-1ubuntu4.10
1.0.2g-1ubuntu4.11
1.0.2g-1ubuntu4.12
1.0.2g-1ubuntu4.13
1.0.2g-1ubuntu4.14
1.0.2g-1ubuntu4.15

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libssl1.0.0-udeb-dbgsym": "1.0.2g-1ubuntu4.16",
            "libssl-dev": "1.0.2g-1ubuntu4.16",
            "libssl1.0.0": "1.0.2g-1ubuntu4.16",
            "libssl-doc": "1.0.2g-1ubuntu4.16",
            "libcrypto1.0.0-udeb-dbgsym": "1.0.2g-1ubuntu4.16",
            "libssl1.0.0-dbg": "1.0.2g-1ubuntu4.16",
            "libssl-dev-dbgsym": "1.0.2g-1ubuntu4.16",
            "openssl": "1.0.2g-1ubuntu4.16",
            "openssl-dbgsym": "1.0.2g-1ubuntu4.16",
            "libssl1.0.0-udeb": "1.0.2g-1ubuntu4.16",
            "libssl1.0.0-dbgsym": "1.0.2g-1ubuntu4.16",
            "libcrypto1.0.0-udeb": "1.0.2g-1ubuntu4.16"
        }
    ]
}

Ubuntu:18.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.1.1-1ubuntu2.1~18.04.6?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1-1ubuntu2.1~18.04.6

Affected versions

1.*

1.0.2g-1ubuntu13
1.0.2g-1ubuntu14
1.0.2n-1ubuntu1
1.1.0g-2ubuntu1
1.1.0g-2ubuntu2
1.1.0g-2ubuntu3
1.1.0g-2ubuntu4
1.1.0g-2ubuntu4.1
1.1.0g-2ubuntu4.3
1.1.1-1ubuntu2.1~18.04.1
1.1.1-1ubuntu2.1~18.04.2
1.1.1-1ubuntu2.1~18.04.3
1.1.1-1ubuntu2.1~18.04.4
1.1.1-1ubuntu2.1~18.04.5

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libssl-doc": "1.1.1-1ubuntu2.1~18.04.6",
            "libssl-dev": "1.1.1-1ubuntu2.1~18.04.6",
            "libssl1.1-dbgsym": "1.1.1-1ubuntu2.1~18.04.6",
            "libssl1.1-udeb": "1.1.1-1ubuntu2.1~18.04.6",
            "libssl1.1": "1.1.1-1ubuntu2.1~18.04.6",
            "openssl-dbgsym": "1.1.1-1ubuntu2.1~18.04.6",
            "libcrypto1.1-udeb": "1.1.1-1ubuntu2.1~18.04.6",
            "openssl": "1.1.1-1ubuntu2.1~18.04.6"
        }
    ]
}

Ubuntu:18.04:LTS / openssl1.0

Package

Name
openssl1.0
Purl
pkg:deb/ubuntu/openssl1.0@1.0.2n-1ubuntu5.4?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.2n-1ubuntu5.4

Affected versions

1.*

1.0.2n-1ubuntu2
1.0.2n-1ubuntu3
1.0.2n-1ubuntu4
1.0.2n-1ubuntu5
1.0.2n-1ubuntu5.1
1.0.2n-1ubuntu5.2
1.0.2n-1ubuntu5.3

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libssl1.0.0-dbgsym": "1.0.2n-1ubuntu5.4",
            "libssl1.0-dev": "1.0.2n-1ubuntu5.4",
            "openssl1.0": "1.0.2n-1ubuntu5.4",
            "openssl1.0-dbgsym": "1.0.2n-1ubuntu5.4",
            "libssl1.0.0-udeb": "1.0.2n-1ubuntu5.4",
            "libssl1.0.0": "1.0.2n-1ubuntu5.4",
            "libcrypto1.0.0-udeb": "1.0.2n-1ubuntu5.4"
        }
    ]
}

Ubuntu:20.04:LTS / openssl

Package

Name
openssl
Purl
pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu1?arch=src?distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.1f-1ubuntu1

Affected versions

1.*

1.1.1c-1ubuntu4
1.1.1d-2ubuntu3
1.1.1d-2ubuntu6

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "libssl-doc": "1.1.1f-1ubuntu1",
            "libssl-dev": "1.1.1f-1ubuntu1",
            "libssl1.1-dbgsym": "1.1.1f-1ubuntu1",
            "libssl1.1-udeb": "1.1.1f-1ubuntu1",
            "libssl1.1": "1.1.1f-1ubuntu1",
            "openssl-dbgsym": "1.1.1f-1ubuntu1",
            "libcrypto1.1-udeb": "1.1.1f-1ubuntu1",
            "openssl": "1.1.1f-1ubuntu1"
        }
    ]
}