CVE-2014-8275 | Ubuntu

OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection mechanism by including crafted data within a certificate's unsigned portion, related to crypto/asn1/a_verify.c, crypto/dsa/dsa_asn1.c, crypto/ecdsa/ecs_vrf.c, and crypto/x509/x_all.c.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
openssl	19.04 disco	Fixed 1.0.1f-1ubuntu10
	18.10 cosmic	Fixed 1.0.1f-1ubuntu10
	18.04 LTS bionic	Fixed 1.0.1f-1ubuntu10
	17.10 artful	Fixed 1.0.1f-1ubuntu10
	17.04 zesty	Fixed 1.0.1f-1ubuntu10
	16.10 yakkety	Fixed 1.0.1f-1ubuntu10
	16.04 LTS xenial	Fixed 1.0.1f-1ubuntu10
	15.10 wily	Fixed 1.0.1f-1ubuntu10
	15.04 vivid	Fixed 1.0.1f-1ubuntu10
	14.10 utopic	Fixed 1.0.1f-1ubuntu9.1
	14.04 LTS trusty	Fixed 1.0.1f-1ubuntu2.8
	12.04 LTS precise	Fixed 1.0.1-4ubuntu5.21
	10.04 LTS lucid	Fixed 0.9.8k-7ubuntu8.23
openssl098	19.04 disco	Not in release
	18.10 cosmic	Not in release
	18.04 LTS bionic	Not in release
	17.10 artful	Not in release
	17.04 zesty	Not in release
	16.10 yakkety	Not in release
	16.04 LTS xenial	Not in release
	15.10 wily	Not in release
	15.04 vivid	Ignored end of life
	14.10 utopic	Ignored end of life
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Ignored end of life
	10.04 LTS lucid	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
openssl	Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=86edf13b1c97526c0cf63c37342aaa01f5442688 Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=5951cc004b96cd681ffdf39d3fc9238a1ff597ae Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=a8565530e27718760220df469f0a071c85b9e731 Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=178c562a4621162dbe19a7c34fa2ad558684f40e Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=7fae32f6d69baf27ef69d92499c59c8a3277f3e3 Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=c22e2dd6e52899926d1f1ee3a2b5b9570d03130f Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=63f3c9e715955f0cdc83698d8a3dfb1b80064407 Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=ec2fede9467ae1a65f452d3a39f7fbc4891d9285 Upstream: https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=11f719da38c5e9aa509aa518d11f71355cca7cd1

Package

Patch details

openssl

References

Related Ubuntu Security Notices (USN)

USN-2459-1
OpenSSL vulnerabilities
12 January 2015

Other references

https://www.cve.org/CVERecord?id=CVE-2014-8275