Severity

High

Vendor

Canonical Ubuntu

Versions Affected

• Canonical Ubuntu 16.04

Description

USN-5328-1 fixed a vulnerability in OpenSSL. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: Tavis Ormandy discovered that OpenSSL incorrectly parsed certain certificates. A remote attacker could possibly use this issue to cause OpenSSH to stop responding, resulting in a denial of service.

CVEs contained in this USN include: CVE-2022-0778.

Affected Cloud Foundry Products and Versions

Severity is high unless otherwise noted.

• CF Deployment
  • All versions with Xenial Stemcells prior to 621.224

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• CF Deployment
  • For all versions, upgrade Xenial Stemcells to 621.224 or greater

References

• USN Notice
• CVE-2022-0778

History

2022-04-21: Initial vulnerability report published.