OpenSSL updates release versions 1.0.2g and 1.0.1s to fix the DROWN vulnerability (CVE-2016-0800). In Ubuntu 14.04 LTS Trusty Tahr, the latest OpenSSL version is 1.0.1f-1ubuntu2.18. Do I understand it correctly that DROWN fixes haven't been backported to Trusty? Are DROWN fixes needed to be incorporated to any Ubuntu versions?
-
ubuntu.com/usn/usn-2914-1 all done.– Arup Roy ChowdhuryCommented Mar 4, 2016 at 8:44
-
@ArupRoyChowdhury that update is not mentioning CVE-2016-0800 but these: CVE-2016-0702, CVE-2016-0705, CVE-2016-0797, CVE-2016-0798, CVE-2016-0799– talamakiCommented Mar 4, 2016 at 8:58
-
5Possible duplicate of How can I tell if a CVE has been fixed in Ubuntu's repositories?– muruCommented Mar 4, 2016 at 12:09
-
DROWN is an old issue - affects SSLv2. SSLv2 is disabled in Ubuntu OpenSSL.– Thomas Ward ♦Commented Apr 13, 2016 at 18:14
Add a comment
|
1 Answer
Priority Medium
Description
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.
Package
Source: openssl098 (LP Ubuntu Debian)
Upstream: needs-triage
Ubuntu 12.04 LTS (Precise Pangolin): not-affected
Ubuntu 14.04 LTS (Trusty Tahr): not-affected
Ubuntu Touch 15.04: DNE
Ubuntu Core 15.04: DNE
Ubuntu 15.10 (Wily Werewolf): DNE
Ubuntu 16.04 (Xenial Xerus): DNE
Package
Source: openssl (LP Ubuntu Debian)
Upstream: needs-triage
Ubuntu 12.04 LTS (Precise Pangolin): not-affected
Ubuntu 14.04 LTS (Trusty Tahr): not-affected
Ubuntu Touch 15.04: not-affected
Ubuntu Core 15.04: not-affected
Ubuntu 15.10 (Wily Werewolf): not-affected
Ubuntu 16.04 (Xenial Xerus): not-affected
- DNE = does not exist
- Ubuntu is not affected by this problem.
