CVE-2011-1945 — openssl - compromised certificate authority

描述

The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.

如何修補 CVE-2011-1945

要修補 CVE-2011-1945,請將受影響套件升級到下列已修補版本。

Debian/openssl—升級至 1.0.0e-1 或更新版本
Debian/openssl—升級至 0.9.8g-15+lenny12 或更新版本

CVE-2011-1945 正在被利用嗎?

低 — EPSS 為 3.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

from 0, < 1.0.0e-1
from 0, < 0.9.8g-15+lenny12

參考連結(1)

ADVISORYsecurity-tracker.debian.org/tracker/CVE-2011-1945