Ubuntu alert USN-8678-2 (openssl, openssl1.0)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8678-2] OpenSSL, OpenSSL 1.0 vulnerabilities
Date:
             
 
Wed, 26 Aug 2026 16:16:19 +0000
Message-ID:
             
 
<E1wzGIV-0000on-CI@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8678-2
August 25, 2026

openssl, openssl1.0 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in OpenSSL and OpenSSL 1.0.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
- openssl1.0: Secure Socket Layer (SSL) cryptographic library and tools

Details:

USN-8678-1 fixed vulnerabilities in OpenSSL. This update provides the
corresponding fix for OpenSSL and OpenSSL 1.0 on Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.

In addition, this update also fixes the following issues that were
not previously addressed in those releases:

It was discovered that OpenSSL incorrectly handled TLS handshake
message buffering. A remote attacker could possibly use this issue to
cause OpenSSL to consume excessive memory, leading to a denial of
service. (LP: #2161371)

It was discovered that OpenSSL incorrectly handled session cache
management when processing TLSv1.3 sessions. A remote attacker could
possibly use this issue to cause OpenSSL to consume excessive memory,
leading to a denial of service. This issue only affected OpenSSL 1.1.1
on Ubuntu 18.04 LTS. (CVE-2024-2511)

It was discovered that OpenSSL incorrectly handled the SSL_select_next_proto
function when called with an empty client protocol list. A remote attacker
could possibly use this issue to cause OpenSSL to disclose private memory
contents to the peer, leading to a loss of confidentiality. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-5535)

Original advisory details:

 It was discovered that OpenSSL incorrectly handled buffering of DTLS
 records for a future epoch. A remote attacker could possibly use this issue
 to cause OpenSSL to use excessive resources, leading to a denial of
 service. (CVE-2026-54874)

 It was discovered that OpenSSL incorrectly handled CMS key unwrapping. A
 remote attacker could possibly use this issue to cause a heap buffer
 overflow, leading to a denial of service or arbitrary code execution.
 (CVE-2026-63072)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
  libssl1.1                       1.1.1f-1ubuntu2.24+esm5
                                  Available with Ubuntu Pro
  openssl                         1.1.1f-1ubuntu2.24+esm5
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  libssl1.0.0                     1.0.2n-1ubuntu5.13+esm6
                                  Available with Ubuntu Pro
  libssl1.1                       1.1.1-1ubuntu2.1~18.04.23+esm10
                                  Available with Ubuntu Pro
  openssl                         1.1.1-1ubuntu2.1~18.04.23+esm10
                                  Available with Ubuntu Pro
  openssl1.0                      1.0.2n-1ubuntu5.13+esm6
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  libssl1.0.0                     1.0.2g-1ubuntu4.20+esm18
                                  Available with Ubuntu Pro
  openssl                         1.0.2g-1ubuntu4.20+esm18
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  libssl1.0.0                     1.0.1f-1ubuntu2.27+esm16
                                  Available with Ubuntu Pro
  openssl                         1.0.1f-1ubuntu2.27+esm16
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8678-2
  https://ubuntu.com/security/notices/USN-8678-1
  CVE-2024-2511, CVE-2024-5535, CVE-2026-54874, CVE-2026-63072


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqPESoACgkQcpJm3tlz
hgEwIQ/8CeqbUOS41i6eC10TXVFreK8Nxra3xNOve4ggo1KV1alzd5lpbI6F1OOT
Ngy0Nu0AqjmU8sWjXEV2Owuw05UiY0wswlyWtmdmWlWoBSPogjqWB6pTVmn7Mpd/
BJSQEQ+perSvWJiXjoOg1FY9Y3rvrSLJlcChnT4xgUTHQrLOI1jW8LM2NjDMZPDd
22QYDMO9+4+392puVSK0VgU6+qmA10Cj2r3wmkWMXc4JMnnsStjSIrWo/a0dorvg
3gRu9PhlEuj55qGdqVHqLerqYqXW8hqwT6E691+BcLYVvxVQR3eXP5ix1vsxHS7E
tBFKx0WyKPAoKwY6j2DFCYNIz9aR0LetcWMTkQojFgZr8NnsFeUnMkmN2QnmiZUJ
sb3kVHJEUW0ySFIAocRaI35NvlxyHHK9NuU1FttOQEhhWjeCqc6X/nkLzqmUKs3w
lfaH0CUnNQt/lFajF5Z2rbP/Mt/5v642ZZTJEIUNUWebVd6Jyhe6tghVu/tQDFCH
DMoTUeDspFBIV2+bdMel02UpCtdQMVFbnX+H8GAi1AMwmVrPIoBvZdKdj3NIfeuW
RfARPcT1sIjkn7oAY+ZXBGiN/Mpvgd76BrUd0/tJaSoqJJIn3ubRFNQTcRW1fRBz
/A/xEUCQKef97mc4MJwiTWlhufiFNFAseX495qbEIwL7ZMBitIY=
=44sY
-----END PGP SIGNATURE-----