Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

OpenSSL updates release versions 1.0.2g and 1.0.1s to fix the DROWN vulnerability (CVE-2016-0800). In Ubuntu 14.04 LTS Trusty Tahr, the latest OpenSSL version is 1.0.1f-1ubuntu2.18. Do I understand it correctly that DROWN fixes haven't been backported to Trusty? Are DROWN fixes needed to be incorporated to any Ubuntu versions?

share|improve this question
    
ubuntu.com/usn/usn-2914-1 all done. – Arup Roy Chowdhury Mar 4 at 8:44
    
@ArupRoyChowdhury that update is not mentioning CVE-2016-0800 but these: CVE-2016-0702, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798, CVE-2016-0799 – talamaki Mar 4 at 8:58
5  
    
DROWN is an old issue - affects SSLv2. SSLv2 is disabled in Ubuntu OpenSSL. – Thomas W. Apr 13 at 18:14
up vote 17 down vote accepted

CVE-2016-0800:

Priority Medium

Description

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

Package
Source: openssl098 (LP Ubuntu Debian)
Upstream:   needs-triage
Ubuntu 12.04 LTS (Precise Pangolin):    not-affected
Ubuntu 14.04 LTS (Trusty Tahr): not-affected
Ubuntu Touch 15.04: DNE
Ubuntu Core 15.04:  DNE
Ubuntu 15.10 (Wily Werewolf):   DNE
Ubuntu 16.04 (Xenial Xerus):    DNE

Package
Source: openssl (LP Ubuntu Debian)
Upstream:   needs-triage
Ubuntu 12.04 LTS (Precise Pangolin):    not-affected
Ubuntu 14.04 LTS (Trusty Tahr): not-affected
Ubuntu Touch 15.04: not-affected
Ubuntu Core 15.04:  not-affected
Ubuntu 15.10 (Wily Werewolf):   not-affected
Ubuntu 16.04 (Xenial Xerus):    not-affected

  • DNE = does not exist
  • Ubuntu is not affected by this problem.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.