Severity
High
Vendor
Canonical Ubuntu
Versions Affected
- Canonical Ubuntu 16.04
Description
USN-5328-1 fixed a vulnerability in OpenSSL. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Tavis Ormandy discovered that OpenSSL incorrectly parsed certain certificates. A remote attacker could possibly use this issue to cause OpenSSH to stop responding, resulting in a denial of service.
CVEs contained in this USN include: CVE-2022-0778.
Affected Cloud Foundry Products and Versions
Severity is high unless otherwise noted.
- CF Deployment
- All versions with Xenial Stemcells prior to 621.224
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
- CF Deployment
- For all versions, upgrade Xenial Stemcells to 621.224 or greater
References
History
2022-04-21: Initial vulnerability report published.
