Cette page suit l'état du correctif pour Ubuntu. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2022-2097 →

UBUNTU-CVE-2022-2097

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumst...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Ubuntu:Pro:16.04:LTS edk2

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:18.04:LTS openssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.20"}]}]

Ubuntu:Pro:FIPS-updates:18.04:LTS openssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.fips.2.1~18.04.20"}]}]

Ubuntu:Pro:FIPS:18.04:LTS openssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:20.04:LTS openssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.16"}]}]

Ubuntu:Pro:FIPS-updates:20.04:LTS openssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.fips.16"}]}]

Ubuntu:Pro:FIPS:20.04:LTS openssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Ubuntu:22.04:LTS nodejs

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.22.9~dfsg-1ubuntu3.1"}]}]

Ubuntu:22.04:LTS openssl

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.6"}]}]

Références

advisory ubuntu.com
advisory ubuntu.com
report ubuntu.com
report openssl.org
report cve.org