[USN-3840-1] OpenSSL vulnerabilities

---------- Forwarded message ---------
From: Marc Deslauriers
Date: 2018年12月7日 週五 上午4:49

Samuel Weiser discovered that OpenSSL incorrectly handled DSA signing. An
attacker could possibly use this issue to perform a timing side-channel
attack and recover private DSA keys. (CVE-2018-0734)

Samuel Weiser discovered that OpenSSL incorrectly handled ECDSA signing. An
attacker could possibly use this issue to perform a timing side-channel
attack and recover private ECDSA keys. This issue only affected Ubuntu
18.04 LTS and Ubuntu 18.10. (CVE-2018-0735)

Billy Bob Brumley, Cesar Pereida Garcia, Sohaib ul Hassan, Nicola Tuveri,
and Alejandro Cabrera Aldaya discovered that Simultaneous Multithreading
(SMT) architectures are vulnerable to side-channel leakage. This issue is
known as "PortSmash". An attacker could possibly use this issue to perform
a timing side-channel attack and recover private keys. (CVE-2018-5407)

References:
  https://usn.ubuntu.com/usn/usn-3840-1
  CVE-2018-0734, CVE-2018-0735, CVE-2018-5407