|| ||Seth Arnold <firstname.lastname@example.org> |
|| ||email@example.com |
|| ||[USN-1898-1] OpenSSL vulnerability |
|| ||Wed, 3 Jul 2013 18:47:38 -0700|
|| ||Article, Thread
Ubuntu Security Notice USN-1898-1
July 04, 2013
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
- Ubuntu 10.04 LTS
Applications could be made to expose sensitive information over the
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
The TLS protocol 1.2 and earlier can encrypt compressed data without
properly obfuscating the length of the unencrypted data, which allows
man-in-the-middle attackers to obtain plaintext content by observing
length differences during a series of guesses in which a provided string
potentially matches an unknown string in encrypted and compressed traffic.
This is known as a CRIME attack in HTTP. Other protocols layered on top of
TLS may also make these attacks practical.
This update disables compression for all programs using SSL and TLS
provided by the OpenSSL library. To re-enable compression for programs
that need compression to communicate with legacy services, define the
variable OPENSSL_DEFAULT_ZLIB in the program's environment.
The problem can be corrected by updating your system to the following
Ubuntu 12.04 LTS:
Ubuntu 10.04 LTS:
In general, a standard system update will make all the necessary changes.
ubuntu-security-announce mailing list
Modify settings or unsubscribe at:
to post comments)