[USN-6632-1] OpenSSL vulnerabilities
[USN-6633-1] Bind vulnerabilities
[USN-6629-1] UltraJSON vulnerabilities
[USN-6634-1] .NET vulnerabilities
[USN-6632-1] OpenSSL vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6632-1
February 13, 2024
openssl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in OpenSSL.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
David Benjamin discovered that OpenSSL incorrectly handled excessively long
X9.42 DH keys. A remote attacker could possibly use this issue to cause
OpenSSL to consume resources, leading to a denial of service.
(CVE-2023-5678)
Bahaa Naamneh discovered that OpenSSL incorrectly handled certain malformed
PKCS12 files. A remote attacker could possibly use this issue to cause
OpenSSL to crash, resulting in a denial of service. (CVE-2024-0727)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libssl1.1 1.1.1-1ubuntu2.1~18.04.23+esm4
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libssl1.0.0 1.0.2g-1ubuntu4.20+esm11
After a standard system update you need to reboot your computer to make
all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6632-1
CVE-2023-5678, CVE-2024-0727
[USN-6633-1] Bind vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6633-1
February 13, 2024
bind9 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in Bind.
Software Description:
- bind9: Internet Domain Name Server
Details:
Shoham Danino, Anat Bremler-Barr, Yehuda Afek, and Yuval Shavitt discovered
that Bind incorrectly handled parsing large DNS messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-4408)
Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner discovered
that Bind icorrectly handled validating DNSSEC messages. A remote attacker
could possibly use this issue to cause Bind to consume resources, leading
to a denial of service. (CVE-2023-50387)
It was discovered that Bind incorrectly handled preparing an NSEC3 closest
encloser proof. A remote attacker could possibly use this issue to cause
Bind to consume resources, leading to a denial of service. (CVE-2023-50868)
It was discovered that Bind incorrectly handled reverse zone queries when
nxdomain-redirect is enabled. A remote attacker could possibly use this
issue to cause Bind to crash, leading to a denial of service.
(CVE-2023-5517)
It was discovered that Bind incorrectly handled recursive resolution when
both DNS64 and serve-stable were enabled. A remote attacker could possibly
use this issue to cause Bind to crash, leading to a denial of service.
(CVE-2023-5679)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
bind9 1:9.18.18-0ubuntu2.1
Ubuntu 22.04 LTS:
bind9 1:9.18.18-0ubuntu0.22.04.2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6633-1
CVE-2023-4408, CVE-2023-50387, CVE-2023-50868, CVE-2023-5517,
CVE-2023-5679
Package Information:
https://launchpad.net/ubuntu/+source/bind9/1:9.18.18-0ubuntu2.1
https://launchpad.net/ubuntu/+source/bind9/1:9.18.18-0ubuntu0.22.04.2
[USN-6629-1] UltraJSON vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6629-1
February 14, 2024
ujson vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS (Available with Ubuntu Pro)
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in UltraJSON.
Software Description:
- ujson: ultra fast JSON encoder and decoder for Python 3
Details:
It was discovered that UltraJSON incorrectly handled certain input with
a large amount of indentation. An attacker could possibly use this issue
to crash the program, resulting in a denial of service. (CVE-2021-45958)
Jake Miller discovered that UltraJSON incorrectly decoded certain
characters. An attacker could possibly use this issue to cause key
confusion and overwrite values in dictionaries. (CVE-2022-31116)
It was discovered that UltraJSON incorrectly handled an error when
reallocating a buffer for string decoding. An attacker could possibly
use this issue to corrupt memory. (CVE-2022-31117)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS (Available with Ubuntu Pro):
python3-ujson 5.1.0-1ubuntu0.1~esm1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
python-ujson 1.35-2ubuntu0.1~esm1
python3-ujson 1.35-2ubuntu0.1~esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
python-ujson 1.33-1ubuntu0.1~esm2
python3-ujson 1.33-1ubuntu0.1~esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6629-1
CVE-2021-45958, CVE-2022-31116, CVE-2022-31117
[USN-6634-1] .NET vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6634-1
February 13, 2024
dotnet6, dotnet7, dotnet8 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in .NET.
Software Description:
- dotnet6: dotNET CLI tools and runtime
- dotnet7: dotNET CLI tools and runtime
- dotnet8: dotNET CLI tools and runtime
Details:
Brennan Conroy discovered that .NET with SignalR did not properly
handle malicious clients. An attacker could possibly use this issue
to cause a denial of service. (CVE-2024-21386)
Bahaa Naamneh discovered that .NET with OpenSSL support did not
properly parse X509 certificates. An attacker could possibly use
this issue to cause a denial of service. (CVE-2024-21404)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
aspnetcore-runtime-6.0 6.0.127-0ubuntu1~23.10.1
aspnetcore-runtime-7.0 7.0.116-0ubuntu1~23.10.1
aspnetcore-runtime-8.0 8.0.2-0ubuntu1~23.10.1
dotnet-host 6.0.127-0ubuntu1~23.10.1
dotnet-host-7.0 7.0.116-0ubuntu1~23.10.1
dotnet-host-8.0 8.0.2-0ubuntu1~23.10.1
dotnet-hostfxr-6.0 6.0.127-0ubuntu1~23.10.1
dotnet-hostfxr-7.0 7.0.116-0ubuntu1~23.10.1
dotnet-hostfxr-8.0 8.0.2-0ubuntu1~23.10.1
dotnet-runtime-6.0 6.0.127-0ubuntu1~23.10.1
dotnet-runtime-7.0 7.0.116-0ubuntu1~23.10.1
dotnet-runtime-8.0 8.0.2-0ubuntu1~23.10.1
dotnet-sdk-6.0 6.0.127-0ubuntu1~23.10.1
dotnet-sdk-7.0 7.0.116-0ubuntu1~23.10.1
dotnet-sdk-8.0 8.0.102-0ubuntu1~23.10.1
dotnet6 6.0.127-0ubuntu1~23.10.1
dotnet7 7.0.116-0ubuntu1~23.10.1
dotnet8 8.0.102-8.0.2-0ubuntu1~23.10.1
Ubuntu 22.04 LTS:
aspnetcore-runtime-6.0 6.0.127-0ubuntu1~22.04.1
aspnetcore-runtime-7.0 7.0.116-0ubuntu1~22.04.1
aspnetcore-runtime-8.0 8.0.2-0ubuntu1~22.04.1
dotnet-host 6.0.127-0ubuntu1~22.04.1
dotnet-host-7.0 7.0.116-0ubuntu1~22.04.1
dotnet-host-8.0 8.0.2-0ubuntu1~22.04.1
dotnet-hostfxr-6.0 6.0.127-0ubuntu1~22.04.1
dotnet-hostfxr-7.0 7.0.116-0ubuntu1~22.04.1
dotnet-hostfxr-8.0 8.0.2-0ubuntu1~22.04.1
dotnet-runtime-6.0 6.0.127-0ubuntu1~22.04.1
dotnet-runtime-7.0 7.0.116-0ubuntu1~22.04.1
dotnet-runtime-8.0 8.0.2-0ubuntu1~22.04.1
dotnet-sdk-6.0 6.0.127-0ubuntu1~22.04.1
dotnet-sdk-7.0 7.0.116-0ubuntu1~22.04.1
dotnet-sdk-8.0 8.0.102-0ubuntu1~22.04.1
dotnet6 6.0.127-0ubuntu1~22.04.1
dotnet7 7.0.116-0ubuntu1~22.04.1
dotnet8 8.0.102-8.0.2-0ubuntu1~22.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6634-1
CVE-2024-21386, CVE-2024-21404
Package Information:
https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~23.10.1
https://launchpad.net/ubuntu/+source/dotnet6/6.0.127-0ubuntu1~22.04.1
https://launchpad.net/ubuntu/+source/dotnet7/7.0.116-0ubuntu1~22.04.1
https://launchpad.net/ubuntu/+source/dotnet8/8.0.102-8.0.2-0ubuntu1~22.04.1
