Ubuntu alert USN-8847-2 (openssl, openssl1.0)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8847-2] OpenSSL vulnerabilities
Date:
             
 
Wed, 30 Sep 2026 09:40:59 +0000
Message-ID:
             
 
<E1xBqo7-0004B5-6B@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8847-2
September 29, 2026

openssl, openssl1.0 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in OpenSSL.

Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
- openssl1.0: Secure Socket Layer (SSL) cryptographic library and tools

Details:

USN-8847-1 fixed vulnerabilities in OpenSSL. This update provides the
corresponding fix for OpenSSL on Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

Original advisory details:

 It was discovered that OpenSSL incorrectly handled certain certificate
 revocation list distribution point names. An attacker could possibly use
 this issue to cause OpenSSL to consume excessive memory, resulting in a
 denial of service. (CVE-2026-35189)

 It was discovered that OpenSSL incorrectly implemented scalar
 multiplication for non-NIST elliptic curves. An attacker could possibly use
 this issue to perform a timing side-channel attack and obtain
 sensitive information. This issue only affected Ubuntu 18.04 LTS and
 Ubuntu 20.04 LTS. (CVE-2026-54872)

 It was discovered that OpenSSL incorrectly implemented SM2 signature
 generation. An attacker could possibly use this issue to perform a
 timing side-channel attack and obtain sensitive information. This issue
 only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2026-77696)

 It was discovered that OpenSSL incorrectly handled DTLS retransmission
 of handshake messages. An attacker could possibly use this issue to
 cause incorrect handshake behavior or a denial of service.
 (CVE-2026-84782)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
  libssl1.1                       1.1.1f-1ubuntu2.24+esm6
                                  Available with Ubuntu Pro
  openssl                         1.1.1f-1ubuntu2.24+esm6
                                  Available with Ubuntu Pro

Ubuntu 18.04 LTS
  libssl1.0.0                     1.0.2n-1ubuntu5.13+esm7
                                  Available with Ubuntu Pro
  libssl1.1                       1.1.1-1ubuntu2.1~18.04.23+esm11
                                  Available with Ubuntu Pro
  openssl                         1.1.1-1ubuntu2.1~18.04.23+esm11
                                  Available with Ubuntu Pro
  openssl1.0                      1.0.2n-1ubuntu5.13+esm7
                                  Available with Ubuntu Pro

Ubuntu 16.04 LTS
  libssl1.0.0                     1.0.2g-1ubuntu4.20+esm19
                                  Available with Ubuntu Pro
  openssl                         1.0.2g-1ubuntu4.20+esm19
                                  Available with Ubuntu Pro

Ubuntu 14.04 LTS
  libssl1.0.0                     1.0.1f-1ubuntu2.27+esm17
                                  Available with Ubuntu Pro
  openssl                         1.0.1f-1ubuntu2.27+esm17
                                  Available with Ubuntu Pro

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8847-2
  https://ubuntu.com/security/notices/USN-8847-1
  CVE-2026-35189, CVE-2026-54872, CVE-2026-77696, CVE-2026-84782


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq816oACgkQcpJm3tlz
hgH0vw/7BvtT2cgLd+oD3nP4fMbbNN8xETOlvnUvhv6Gs0IxvfwVEhcMNVni2rH8
PnXqQbKhMoRG1YWM5T4iY859IwQ3Mrak2ODg8DWKKPwZ+NxvbNOWTkXrUHxHEAiu
HFSghltEiTp2tTuym74hUk+3ca4YsmP21x5bSgmdM/6zGfM6nNMBapOphzEsUW7p
7JGwTF7ClThYwzzxzqWlMVS77pLBIoOYk1pCaGKAUNDe8cV94AbEpWWobLXKJgT8
vvPCH3NpvbwppQrfs16hc7QsUBgozexL94UFxm+0tKVe+zSzYKWQGoYLrNf5vxjw
9VU8FTWNluLKiPlWvTW2zOMu0wAtoNumMMWm/Oje541+Rdcp0PGYM6gYOLghb8w1
Qrfz94TJZysOJRGLUT9g/Xl+Mk3Qn4UHAmlu+xmxvY7ozJ27uGwLbV8oNrJoxiZk
fgcboHRG5IlEZ8zsCDC05hP7D2XdQZczkZW556xvED1BpkCobe6FNBxemwQyoX2W
3n7WiKhbKeuZLmPI4agq+37lYbpKUpME7d/yxRDX0wdO9l9FOr13gYpYibaw/tpI
x5gzU0JfsiUHfgkLpcUuWKe+H7hpHwOTEwRdQz2tUhw5XGtdoiMIRTZKDxDVqb7C
W3QbMQ4nrlKdZs/M+xnscmGZgZILZHS91hPGL28mZ2L2NfzCLU0=
=5yUL
-----END PGP SIGNATURE-----