Description
The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a timing side channel attack. An attacker could use variations in the signing algorithm to recover the private key. Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i). Fixed in OpenSSL 1.1.1a (Affected 1.1.1).
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenSSL OpenSSL
Fixed in OpenSSL 1.1.0j (Affected 1.1.0-1.1.0i)affectedFixed in OpenSSL 1.1.1a (Affected 1.1.1)affected
References
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=56fb454d281a023b3f950d969693553d3f3ceea1 ↗
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html ↗
- http://www.securityfocus.com/bid/105750 ↗
- https://usn.ubuntu.com/3840-1/ ↗
- https://security.netapp.com/advisory/ntap-20181105-0002/ ↗
- https://nodejs.org/en/blog/vulnerability/november-2018-security-releases/ ↗
- http://www.securitytracker.com/id/1041986 ↗
- https://lists.debian.org/debian-lts-announce/2018/11/msg00024.html ↗
- https://www.debian.org/security/2018/dsa-4348 ↗
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=b1d6d55ece1c26fa2829e2b819b038d7b6d692b4 ↗
- https://www.openssl.org/news/secadv/20181029.txt ↗
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html ↗
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html ↗
- https://access.redhat.com/errata/RHSA-2019:3700 ↗
- https://www.oracle.com/security-alerts/cpujan2020.html ↗