bugtraq - [SECURITY] [DSA 4594-1] openssl1.0 security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20191227221306.h2zoywagk2lp677w@seger.debian.org>
Date: Fri, 27 Dec 2019 22:13:06 +0000
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4594-1] openssl1.0 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4594-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
December 27, 2019                     https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : openssl1.0
CVE ID         : CVE-2019-1551

Guido Vranken discovered an overflow bug in the x64_64 Montgomery
squaring procedure used in exponentiation with 512-bit moduli.

For the oldstable distribution (stretch), this problem has been fixed
in version 1.0.2u-1~deb9u1.

We recommend that you upgrade your openssl1.0 packages.

For the detailed security status of openssl1.0 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openssl1.0

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl4GgDQACgkQEMKTtsN8
TjbA6Q//YmOcdR4EylAVPXL6LhfekZvj+Mm5aqlPWfxkyfLVYPYfWjMjJsziazp4
R14raQEBCQ3vi+zoK0cSOybMCLirLyYg0wS6yoBb8nh3dv9Do9pihRtkVU0w5zF+
HxFqzBPgmh2KW87RkugOQW18RJ/n3qOWTEbrDgKAa0eHOm84j+cnCOCSfQVAarcv
x47kAzudn4tM4LgWw/QM8Tdoz2TOWvySfaXT5KjWyjjxIeYxlU/ujBMxM5xPCyTV
rTkuGhIb/sXfi9EIR60oeyj87qhPowBuvYqDe5BsdrGzaVbIWY5WDTpj1CDw/JPJ
a8zLYwD2TRRXu8VKaB4e2OF4BEIVLc1rPI9hg0ca252JoN4JZwqxnbLd3+jEhZCF
koVBLa2KJwBnI9m0OckRccRro7vFQNgrG0IoCFIIcyTO28BiUpC1rt0tz4nS273L
2l3bO26n7CtMLBQdx49HjOx9HKFzlwQ18M/qCmCOGdIMYgh+WvUFmkC3o3Tm7i5a
5QqD2+7g1aacwudDXgZH+rphnXeBYzRUhVWjDwNXml7y110Agrj5OC+FOOwQseWA
KJBZ0baSPGo/XJkk47n7sN0hwEZyIk4KI43BsG++OozSNK/+g5xPnR8+CEBOeShg
ddIc93Qq6xEFSNE/N34HeUs2xMHEl2jVUBb8jVu+CP504ttO28g=
=uLSP
-----END PGP SIGNATURE-----