[Ach] Fwd: [SECURITY] [DSA 3417-1] bouncycastle security update

L. Aaron Kaplan aaron at lo-res.org
Tue Dec 15 02:14:27 CET 2015


FYI


> Begin forwarded message:
> 
> From: Luciano Bello <luciano at debian.org>
> Subject: [SECURITY] [DSA 3417-1] bouncycastle security update
> Date: 14 Dec 2015 13:51:06 CET
> To: bugtraq at securityfocus.com
> Resent-From: list at bendel.debian.org (Mailing List Manager)
> Resent-Cc: recipient list not shown: ;
> Reply-To: listadmin at SECURITYFOCUS.COM
> 
> Signed PGP part
> -------------------------------------------------------------------------
> Debian Security Advisory DSA-3417-1                   security at debian.org
> https://www.debian.org/security/                            Luciano Bello
> December 14, 2015                     https://www.debian.org/security/faq
> -------------------------------------------------------------------------
> 
> Package        : bouncycastle
> CVE ID         : CVE-2015-7940
> Debian Bug     : 802671
> 
> Tibor Jager, Jörg Schwenk, and Juraj Somorovsky, from Horst Görtz
> Institute for IT Security, published a paper in ESORICS 2015 where they
> describe an invalid curve attack in Bouncy Castle Crypto, a Java library
> for cryptography. An attacker is able to recover private Elliptic Curve
> keys from different applications, for example, TLS servers.
> 
> More information:
> http://web-in-security.blogspot.ca/2015/09/practical-invalid-curve-attacks.html
> Practical Invalid Curve Attacks on TLS-ECDH:
> http://euklid.org/pdf/ECC_Invalid_Curve.pdf
> 
> For the oldstable distribution (wheezy), this problem has been fixed
> in version 1.44+dfsg-3.1+deb7u1.
> 
> For the stable distribution (jessie), this problem has been fixed in
> version 1.49+dfsg-3+deb8u1.
> 
> For the unstable distribution (sid), this problem has been fixed in
> version 1.51-2.
> 
> We recommend that you upgrade your bouncycastle packages.
> 
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
> 
> Mailing list: debian-security-announce at lists.debian.org
> 
> 




More information about the Ach mailing list