Copied from
ubuntu lunar in
Private PPA for Ubuntu Security Team
by Marc Deslauriers
Changelog
openssl (3.0.8-1ubuntu1.4) lunar-security; urgency=medium
[ Marc Deslauriers ]
* SECURITY UPDATE: AES-SIV implementation ignores empty associated data
entries
- debian/patches/CVE-2023-2975.patch: do not ignore empty associated
data with AES-SIV mode in
providers/implementations/ciphers/cipher_aes_siv.c.
- CVE-2023-2975
* SECURITY UPDATE: Incorrect cipher key and IV length processing
- debian/patches/CVE-2023-5363-1.patch: process key length and iv
length early if present in crypto/evp/evp_enc.c.
- debian/patches/CVE-2023-5363-2.patch: add unit test in
test/evp_extra_test.c.
- CVE-2023-5363
[ Ian Constantin ]
* SECURITY UPDATE: denial of service
- debian/patches/CVE-2023-3446.patch: adds check to prevent the testing of
an excessively large modulus in DH_check().
- CVE-2023-3446
* SECURITY UPDATE: denial of service
- debian/patches/CVE-2023-3817.patch: adds check to prevent the testing of
invalid q values in DH_check().
- CVE-2023-3817
-- Marc Deslauriers <email address hidden> Fri, 13 Oct 2023 08:02:49 -0400