Vulnerability-Lookup

ubuntu-cve-2020-1968

Vulnerability from osv_ubuntu

Published

2020-09-09 00:00

Modified

2026-04-27 14:13

Summary

Details

The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).

Severity

3.7 (Low)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

3.7 (Low)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2020-1968	REPORT
	https://www.openssl.org/news/secadv/20200909.txt	REPORT
	https://ubuntu.com/security/notices/USN-4504-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2020-1968	REPORT
	https://ubuntu.com/security/notices/USN-7018-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libssl1.0.0",
            "binary_version": "1.0.1f-1ubuntu2.27+esm10"
          },
          {
            "binary_name": "openssl",
            "binary_version": "1.0.1f-1ubuntu2.27+esm10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "openssl",
        "purl": "pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.27+esm10?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1f-1ubuntu2.27+esm10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1e-3ubuntu1",
        "1.0.1e-4ubuntu1",
        "1.0.1e-4ubuntu2",
        "1.0.1e-4ubuntu3",
        "1.0.1e-4ubuntu4",
        "1.0.1f-1ubuntu1",
        "1.0.1f-1ubuntu2",
        "1.0.1f-1ubuntu2.1",
        "1.0.1f-1ubuntu2.2",
        "1.0.1f-1ubuntu2.3",
        "1.0.1f-1ubuntu2.4",
        "1.0.1f-1ubuntu2.5",
        "1.0.1f-1ubuntu2.7",
        "1.0.1f-1ubuntu2.8",
        "1.0.1f-1ubuntu2.11",
        "1.0.1f-1ubuntu2.12",
        "1.0.1f-1ubuntu2.15",
        "1.0.1f-1ubuntu2.16",
        "1.0.1f-1ubuntu2.17",
        "1.0.1f-1ubuntu2.18",
        "1.0.1f-1ubuntu2.19",
        "1.0.1f-1ubuntu2.20",
        "1.0.1f-1ubuntu2.21",
        "1.0.1f-1ubuntu2.22",
        "1.0.1f-1ubuntu2.23",
        "1.0.1f-1ubuntu2.24",
        "1.0.1f-1ubuntu2.25",
        "1.0.1f-1ubuntu2.26",
        "1.0.1f-1ubuntu2.27",
        "1.0.1f-1ubuntu2.27+esm1",
        "1.0.1f-1ubuntu2.27+esm2",
        "1.0.1f-1ubuntu2.27+esm3",
        "1.0.1f-1ubuntu2.27+esm4",
        "1.0.1f-1ubuntu2.27+esm5",
        "1.0.1f-1ubuntu2.27+esm6",
        "1.0.1f-1ubuntu2.27+esm7",
        "1.0.1f-1ubuntu2.27+esm9"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libssl1.0.0",
            "binary_version": "1.0.2g-1ubuntu4.17"
          },
          {
            "binary_name": "openssl",
            "binary_version": "1.0.2g-1ubuntu4.17"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "openssl",
        "purl": "pkg:deb/ubuntu/openssl@1.0.2g-1ubuntu4.17?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.2g-1ubuntu4.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.2d-0ubuntu1",
        "1.0.2d-0ubuntu2",
        "1.0.2e-1ubuntu1",
        "1.0.2f-2ubuntu1",
        "1.0.2g-1ubuntu2",
        "1.0.2g-1ubuntu3",
        "1.0.2g-1ubuntu4",
        "1.0.2g-1ubuntu4.1",
        "1.0.2g-1ubuntu4.2",
        "1.0.2g-1ubuntu4.4",
        "1.0.2g-1ubuntu4.5",
        "1.0.2g-1ubuntu4.6",
        "1.0.2g-1ubuntu4.8",
        "1.0.2g-1ubuntu4.9",
        "1.0.2g-1ubuntu4.10",
        "1.0.2g-1ubuntu4.11",
        "1.0.2g-1ubuntu4.12",
        "1.0.2g-1ubuntu4.13",
        "1.0.2g-1ubuntu4.14",
        "1.0.2g-1ubuntu4.15",
        "1.0.2g-1ubuntu4.16"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ovmf",
            "binary_version": "0~20160408.ffea0a2c-2ubuntu0.2+esm3"
          },
          {
            "binary_name": "qemu-efi",
            "binary_version": "0~20160408.ffea0a2c-2ubuntu0.2+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "edk2",
        "purl": "pkg:deb/ubuntu/edk2@0~20160408.ffea0a2c-2ubuntu0.2+esm3?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0~20150106.5c2d456b-2",
        "0~20160104.c2a892d7-1",
        "0~20160408.ffea0a2c-2",
        "0~20160408.ffea0a2c-2ubuntu0.1",
        "0~20160408.ffea0a2c-2ubuntu0.2",
        "0~20160408.ffea0a2c-2ubuntu0.2+esm1",
        "0~20160408.ffea0a2c-2ubuntu0.2+esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libssl1.0.0",
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1"
          },
          {
            "binary_name": "libssl1.0.0-hmac",
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1"
          },
          {
            "binary_name": "openssl",
            "binary_version": "1.0.2g-1ubuntu4.fips.4.17.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS",
        "name": "openssl",
        "purl": "pkg:deb/ubuntu/openssl@1.0.2g-1ubuntu4.fips.4.17.1?arch=source\u0026distro=fips-updates/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.2g-1ubuntu4.fips.4.17.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.2g-1ubuntu4.fips.4.9.1",
        "1.0.2g-1ubuntu4.fips.4.13.1",
        "1.0.2g-1ubuntu4.fips.4.15.1",
        "1.0.2g-1ubuntu4.fips.4.16.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libssl1.0.0",
            "binary_version": "1.0.2g-1ubuntu4.fips.4.6.3"
          },
          {
            "binary_name": "libssl1.0.0-hmac",
            "binary_version": "1.0.2g-1ubuntu4.fips.4.6.3"
          },
          {
            "binary_name": "openssl",
            "binary_version": "1.0.2g-1ubuntu4.fips.4.6.3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:FIPS:16.04:LTS",
        "name": "openssl",
        "purl": "pkg:deb/ubuntu/openssl@1.0.2g-1ubuntu4.fips.4.6.3?arch=source\u0026distro=fips/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.2g-1ubuntu4.fips.4.6~ppa1",
        "1.0.2g-1ubuntu4.fips.4.6~ppa2",
        "1.0.2g-1ubuntu4.fips.4.6~ppa3",
        "1.0.2g-1ubuntu4.fips.4.6",
        "1.0.2g-1ubuntu4.fips.4.6.1",
        "1.0.2g-1ubuntu4.fips.4.6.2",
        "1.0.2g-1ubuntu4.fips.4.6.3"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libssl1.0.0",
            "binary_version": "1.0.2n-1ubuntu5.4"
          },
          {
            "binary_name": "openssl1.0",
            "binary_version": "1.0.2n-1ubuntu5.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "openssl1.0",
        "purl": "pkg:deb/ubuntu/openssl1.0@1.0.2n-1ubuntu5.4?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.2n-1ubuntu5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.2n-1ubuntu2",
        "1.0.2n-1ubuntu3",
        "1.0.2n-1ubuntu4",
        "1.0.2n-1ubuntu5",
        "1.0.2n-1ubuntu5.1",
        "1.0.2n-1ubuntu5.2",
        "1.0.2n-1ubuntu5.3"
      ]
    }
  ],
  "aliases": [],
  "details": "The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v).",
  "id": "UBUNTU-CVE-2020-1968",
  "modified": "2026-04-27T14:13:07Z",
  "published": "2020-09-09T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-1968"
    },
    {
      "type": "REPORT",
      "url": "https://www.openssl.org/news/secadv/20200909.txt"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4504-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-1968"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7018-1"
    }
  ],
  "related": [
    "USN-4504-1",
    "USN-7018-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2020-1968"
  ]
}

CVE-2020-1968 (GCVE-0-2020-1968)

Vulnerability from cvelistv5 – Published: 2020-09-09 13:50 – Updated: 2026-04-16 14:10

Title

Raccoon attack

Summary

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-16 14:10 UTC

CWE

Protocol flaw
CWE-203 - Observable Discrepancy

Assigner

openssl mitre root

References

10 references

URL	Tags
https://www.openssl.org/news/secadv/20200909.txt
https://usn.ubuntu.com/4504-1/	vendor-advisory
https://lists.debian.org/debian-lts-announce/2020…	mailing-list
https://www.oracle.com/security-alerts/cpujan2021.html
https://security.netapp.com/advisory/ntap-2020091…
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.oracle.com/security-alerts/cpuoct2021.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://security.gentoo.org/glsa/202210-02	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
OpenSSL	OpenSSL	Affected: Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v)

Date Public

2020-09-09 00:00

Credits

Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T06:54:00.367Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.openssl.org/news/secadv/20200909.txt"
          },
          {
            "name": "USN-4504-1",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4504-1/"
          },
          {
            "name": "[debian-lts-announce] 20200925 [SECURITY] [DLA 2378-1] openssl1.0 security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00016.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20200911-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "name": "GLSA-202210-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202210-02"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 3.7,
              "baseSeverity": "LOW",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-1968",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-16T14:10:30.475111Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-203",
                "description": "CWE-203 Observable Discrepancy",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-16T14:10:35.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenSSL",
          "vendor": "OpenSSL",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v)"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky"
        }
      ],
      "datePublic": "2020-09-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in connections which have used a Diffie-Hellman (DH) based ciphersuite. In such a case this would result in the attacker being able to eavesdrop on all encrypted communications sent over that TLS connection. The attack can only be exploited if an implementation re-uses a DH secret across multiple TLS connections. Note that this issue only impacts DH ciphersuites and not ECDH ciphersuites. This issue affects OpenSSL 1.0.2 which is out of support and no longer receiving public updates. OpenSSL 1.1.1 is not vulnerable to this issue. Fixed in OpenSSL 1.0.2w (Affected 1.0.2-1.0.2v)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "lang": "eng",
              "url": "https://www.openssl.org/policies/secpolicy.html#Low",
              "value": "Low"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Protocol flaw",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-16T00:00:00.000Z",
        "orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
        "shortName": "openssl"
      },
      "references": [
        {
          "url": "https://www.openssl.org/news/secadv/20200909.txt"
        },
        {
          "name": "USN-4504-1",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://usn.ubuntu.com/4504-1/"
        },
        {
          "name": "[debian-lts-announce] 20200925 [SECURITY] [DLA 2378-1] openssl1.0 security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00016.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpujan2021.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20200911-0004/"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "name": "GLSA-202210-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202210-02"
        }
      ],
      "title": "Raccoon attack"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5",
    "assignerShortName": "openssl",
    "cveId": "CVE-2020-1968",
    "datePublished": "2020-09-09T13:50:12.423Z",
    "dateReserved": "2019-12-03T00:00:00.000Z",
    "dateUpdated": "2026-04-16T14:10:35.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-4504-1

Vulnerability from osv_ubuntu

Published

2020-09-16 13:58

Modified

2026-04-27 14:11

Summary

openssl, openssl1.0 vulnerabilities

Details

Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky discovered that certain Diffie-Hellman ciphersuites in the TLS specification and implemented by OpenSSL contained a flaw. A remote attacker could possibly use this issue to eavesdrop on encrypted communications. This was fixed in this update by removing the insecure ciphersuites from OpenSSL. (CVE-2020-1968)

Cesar Pereida García, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin, Alejandro Cabrera Aldaya, and Billy Brumley discovered that OpenSSL incorrectly handled ECDSA signatures. An attacker could possibly use this issue to perform a timing side-channel attack and recover private ECDSA keys. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-1547)

Guido Vranken discovered that OpenSSL incorrectly performed the x86_64 Montgomery squaring procedure. While unlikely, a remote attacker could possibly use this issue to recover private keys. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-1551)

Bernd Edlinger discovered that OpenSSL incorrectly handled certain decryption functions. In certain scenarios, a remote attacker could possibly use this issue to perform a padding oracle attack and decrypt traffic. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-1563)

References

URL

Type

	https://ubuntu.com/security/notices/USN-4504-1	ADVISORY
	https://ubuntu.com/security/CVE-2019-1547	REPORT
	https://ubuntu.com/security/CVE-2019-1551	REPORT
	https://ubuntu.com/security/CVE-2019-1563	REPORT
	https://ubuntu.com/security/CVE-2020-1968	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2020-1968",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libssl1.0.0",
            "binary_version": "1.0.2g-1ubuntu4.17"
          },
          {
            "binary_name": "openssl",
            "binary_version": "1.0.2g-1ubuntu4.17"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "openssl",
        "purl": "pkg:deb/ubuntu/openssl@1.0.2g-1ubuntu4.17?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.2g-1ubuntu4.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.2d-0ubuntu1",
        "1.0.2d-0ubuntu2",
        "1.0.2e-1ubuntu1",
        "1.0.2f-2ubuntu1",
        "1.0.2g-1ubuntu2",
        "1.0.2g-1ubuntu3",
        "1.0.2g-1ubuntu4",
        "1.0.2g-1ubuntu4.1",
        "1.0.2g-1ubuntu4.2",
        "1.0.2g-1ubuntu4.4",
        "1.0.2g-1ubuntu4.5",
        "1.0.2g-1ubuntu4.6",
        "1.0.2g-1ubuntu4.8",
        "1.0.2g-1ubuntu4.9",
        "1.0.2g-1ubuntu4.10",
        "1.0.2g-1ubuntu4.11",
        "1.0.2g-1ubuntu4.12",
        "1.0.2g-1ubuntu4.13",
        "1.0.2g-1ubuntu4.14",
        "1.0.2g-1ubuntu4.15",
        "1.0.2g-1ubuntu4.16"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2019-1547",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2019-1551",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2019-1563",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2020-1968",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libssl1.0.0",
            "binary_version": "1.0.2n-1ubuntu5.4"
          },
          {
            "binary_name": "openssl1.0",
            "binary_version": "1.0.2n-1ubuntu5.4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "openssl1.0",
        "purl": "pkg:deb/ubuntu/openssl1.0@1.0.2n-1ubuntu5.4?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.2n-1ubuntu5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.2n-1ubuntu2",
        "1.0.2n-1ubuntu3",
        "1.0.2n-1ubuntu4",
        "1.0.2n-1ubuntu5",
        "1.0.2n-1ubuntu5.1",
        "1.0.2n-1ubuntu5.2",
        "1.0.2n-1ubuntu5.3"
      ]
    }
  ],
  "aliases": [],
  "details": "Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky\ndiscovered that certain Diffie-Hellman ciphersuites in the TLS\nspecification and implemented by OpenSSL contained a flaw. A remote\nattacker could possibly use this issue to eavesdrop on encrypted\ncommunications. This was fixed in this update by removing the insecure\nciphersuites from OpenSSL. (CVE-2020-1968)\n\nCesar Pereida Garc\u00eda, Sohaib ul Hassan, Nicola Tuveri, Iaroslav Gridin,\nAlejandro Cabrera Aldaya, and Billy Brumley discovered that OpenSSL\nincorrectly handled ECDSA signatures. An attacker could possibly use this\nissue to perform a timing side-channel attack and recover private ECDSA\nkeys. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-1547)\n\nGuido Vranken discovered that OpenSSL incorrectly performed the x86_64\nMontgomery squaring procedure. While unlikely, a remote attacker could\npossibly use this issue to recover private keys. This issue only affected\nUbuntu 18.04 LTS. (CVE-2019-1551)\n\nBernd Edlinger discovered that OpenSSL incorrectly handled certain\ndecryption functions. In certain scenarios, a remote attacker could\npossibly use this issue to perform a padding oracle attack and decrypt\ntraffic. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-1563)\n\n",
  "id": "USN-4504-1",
  "modified": "2026-04-27T14:11:25Z",
  "published": "2020-09-16T13:58:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-4504-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-1547"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-1551"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2019-1563"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-1968"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "openssl, openssl1.0 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2019-1547",
    "UBUNTU-CVE-2019-1551",
    "UBUNTU-CVE-2019-1563",
    "UBUNTU-CVE-2020-1968"
  ]
}

usn-7018-1

Vulnerability from osv_ubuntu

Published

2024-09-18 00:38

Modified

2026-06-29 10:53

Summary

openssl vulnerabilities

Details

Paul Kehrer discovered that OpenSSL incorrectly handled certain input lengths in EVP functions. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2021-23840)

Elison Niven discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run. (CVE-2022-1292)

Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run. (CVE-2022-2068)

It was discovered that OpenSSL incorrectly handled excessively large Diffie-Hellman parameters. An attacker could possibly use this issue to cause a denial of service. (CVE-2023-3446)

Bahaa Naamneh discovered that OpenSSL incorrectly handled certain malformed PKCS12 files. A remote attacker could possibly use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2024-0727)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7018-1	ADVISORY
	https://ubuntu.com/security/CVE-2020-1968	REPORT
	https://ubuntu.com/security/CVE-2021-23840	REPORT
	https://ubuntu.com/security/CVE-2022-1292	REPORT
	https://ubuntu.com/security/CVE-2022-2068	REPORT
	https://ubuntu.com/security/CVE-2023-3446	REPORT
	https://ubuntu.com/security/CVE-2024-0727	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2020-1968",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-23840",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-1292",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-2068",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-3446",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-0727",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libssl1.0.0",
            "binary_version": "1.0.1f-1ubuntu2.27+esm10"
          },
          {
            "binary_name": "openssl",
            "binary_version": "1.0.1f-1ubuntu2.27+esm10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "openssl",
        "purl": "pkg:deb/ubuntu/openssl@1.0.1f-1ubuntu2.27+esm10?arch=source\u0026distro=trusty/esm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.1f-1ubuntu2.27+esm10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.0.1e-3ubuntu1",
        "1.0.1e-4ubuntu1",
        "1.0.1e-4ubuntu2",
        "1.0.1e-4ubuntu3",
        "1.0.1e-4ubuntu4",
        "1.0.1f-1ubuntu1",
        "1.0.1f-1ubuntu2",
        "1.0.1f-1ubuntu2.1",
        "1.0.1f-1ubuntu2.2",
        "1.0.1f-1ubuntu2.3",
        "1.0.1f-1ubuntu2.4",
        "1.0.1f-1ubuntu2.5",
        "1.0.1f-1ubuntu2.7",
        "1.0.1f-1ubuntu2.8",
        "1.0.1f-1ubuntu2.11",
        "1.0.1f-1ubuntu2.12",
        "1.0.1f-1ubuntu2.15",
        "1.0.1f-1ubuntu2.16",
        "1.0.1f-1ubuntu2.17",
        "1.0.1f-1ubuntu2.18",
        "1.0.1f-1ubuntu2.19",
        "1.0.1f-1ubuntu2.20",
        "1.0.1f-1ubuntu2.21",
        "1.0.1f-1ubuntu2.22",
        "1.0.1f-1ubuntu2.23",
        "1.0.1f-1ubuntu2.24",
        "1.0.1f-1ubuntu2.25",
        "1.0.1f-1ubuntu2.26",
        "1.0.1f-1ubuntu2.27",
        "1.0.1f-1ubuntu2.27+esm1",
        "1.0.1f-1ubuntu2.27+esm2",
        "1.0.1f-1ubuntu2.27+esm3",
        "1.0.1f-1ubuntu2.27+esm4",
        "1.0.1f-1ubuntu2.27+esm5",
        "1.0.1f-1ubuntu2.27+esm6",
        "1.0.1f-1ubuntu2.27+esm7",
        "1.0.1f-1ubuntu2.27+esm9"
      ]
    }
  ],
  "aliases": [],
  "details": "Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky\ndiscovered that certain Diffie-Hellman ciphersuites in the TLS\nspecification and implemented by OpenSSL contained a flaw. A remote\nattacker could possibly use this issue to eavesdrop on encrypted\ncommunications. This was fixed in this update by removing the insecure\nciphersuites from OpenSSL. (CVE-2020-1968)\n\nPaul Kehrer discovered that OpenSSL incorrectly handled certain input\nlengths in EVP functions. A remote attacker could possibly use this issue\nto cause OpenSSL to crash, resulting in a denial of service.\n(CVE-2021-23840)\n\nElison Niven discovered that OpenSSL incorrectly handled the c_rehash\nscript. A local attacker could possibly use this issue to execute arbitrary\ncommands when c_rehash is run. (CVE-2022-1292)\n\nChancen and Daniel Fiala discovered that OpenSSL incorrectly handled the\nc_rehash script. A local attacker could possibly use this issue to execute\narbitrary commands when c_rehash is run. (CVE-2022-2068)\n\nIt was discovered that OpenSSL incorrectly handled excessively large\nDiffie-Hellman parameters. An attacker could possibly use this issue\nto cause a denial of service. (CVE-2023-3446)\n\nBahaa Naamneh discovered that OpenSSL incorrectly handled certain malformed\nPKCS12 files. A remote attacker could possibly use this issue to cause\nOpenSSL to crash, resulting in a denial of service. (CVE-2024-0727)\n",
  "id": "USN-7018-1",
  "modified": "2026-06-29T10:53:17Z",
  "published": "2024-09-18T00:38:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7018-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-1968"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-23840"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-1292"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-2068"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-3446"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-0727"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "openssl vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2020-1968",
    "UBUNTU-CVE-2021-23840",
    "UBUNTU-CVE-2022-1292",
    "UBUNTU-CVE-2022-2068",
    "UBUNTU-CVE-2023-3446",
    "UBUNTU-CVE-2024-0727"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ubuntu-cve-2020-1968

Vulnerability from osv_ubuntu

CVE-2020-1968 (GCVE-0-2020-1968)

usn-4504-1

Vulnerability from osv_ubuntu

usn-7018-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour