Users are urged to update their systems immediately

Sep 26, 2016 23:55 GMT  ·  By

After announcing a few days ago that a new, important OpenSSL update is available for all supported Ubuntu Linux operating systems, Canonical's Marc Deslauriers now informs the community about another patch to address a regression.

The new security advisory (USN-3087-2) talks about a regression that was accidentally introduced along with the previous OpenSSL update (as detailed on USN-3087-1), which addressed no less than eleven (11) security vulnerabilities discovered upstream by the OpenSSL team.

Users were urged to upgrade to the following new OpenSSL packages: libssl1.0.0 1.0.2g-1ubuntu4.4 on Ubuntu 16.04 LTS, libssl1.0.0 1.0.1f-1ubuntu2.20 on Ubuntu 14.04 LTS, and libssl1.0.0 1.0.1-4ubuntu5.37 on Ubuntu 12.04 LTS. However, new versions have been published to address the respective regression.

"USN-3087-1 fixed vulnerabilities in OpenSSL. The fix for CVE-2016-2182 was incomplete and caused a regression when parsing certificates. This update fixes the problem. We apologize for the inconvenience," says Canonical in its latest security advisory.

Canonical urges all Ubuntu users to update their systems now

If you updated your Ubuntu Linux operating system lately and installed the OpenSSL packages mentioned above, it's time to do it again. The new package versions are libssl1.0.0 1.0.2g-1ubuntu4.5 for Ubuntu 16.04 LTS, libssl1.0.0 1.0.1f-1ubuntu2.21 for Ubuntu 14.04 LTS, and libssl1.0.0 1.0.1-4ubuntu5.38 for Ubuntu 12.04 LTS.

To update your system, simply open up the Ubuntu Software or Synaptic Package Manager graphical package managers, check for updates and install everything that will be listed there. You can also do it via the command-line by using the "sudo apt-get update && sudo apt-get dist-upgrade" command.

To maintain a strong security level on your Ubuntu Linux installation, it is very important to use the latest OpenSSL packages. For more information on the security vulnerabilities addressed by the new OpenSSL update, check out the original advisory details published by Canonical.