Ubuntu
openssl package

CVE-2014-0160

Bug #1304042 reported by Alex Gaynor
294
This bug affects 9 people
Affects Status Importance Assigned to Milestone
openssl (Debian)
Fix Released
Unknown
openssl (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

The version of OpenSSL which is shipped with Ubuntu is vulnerable to CVE-2014-0160. This is resolved with OpenSSL 1.0.1g (https://www.openssl.org/news/secadv_20140407.txt). This is *extremely* high severity, see heartbleed.com for full information.

CVE References

Alex Gaynor (alex-gaynor)
information type: Private Security → Public Security
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in openssl (Ubuntu):
status: New → Confirmed
Revision history for this message
Kevin Landreth (crackerjackmack) wrote :

Linked as upstream instead of Distribution, fixed.

no longer affects: openssl
Revision history for this message
Seth Arnold (seth-arnold) wrote :

Thanks, fix released: http://www.ubuntu.com/usn/usn-2165-1/

Changed in openssl (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Sven 'Darkman' Michels (sven+launchpad) wrote :

Hi,

why is the urgency in the changelog just "medium" when the bug has a severity of "grave"?
Shouldn't that be enough for high?

And thanks for the quick reaction/fix, good job!

Best regards,
Darkman

Revision history for this message
Seth Arnold (seth-arnold) wrote :

The changelog severities don't mean anything in Ubuntu.

Ubuntu's CVEs aren't tracked by severity, those are our internal priority for fixing them.

All security bugs in Debian have a severity of "grave".

Bug Watch Updater (bug-watch-updater)
Changed in openssl (Debian):
status: Unknown → Fix Released
Revision history for this message
Simon Wong (wongy) wrote :

Thank-you for the rapid response.

To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.