USN-6663-3
openssl update
USN-6663-1 provided a security update for OpenSSL. This update provides the corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
As a security improvement, OpenSSL will now return deterministic random bytes instead of an error when detecting wrong padding in PKCS#1 v1.5 RSA to prevent its use in possible Bleichenbacher timing attacks.
What each source reports
OSV No score
openssl update
USN-6663-1 provided a security update for OpenSSL. This update provides the corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
As a security improvement, OpenSSL will now return deterministic random bytes instead of an error when detecting wrong padding in PKCS#1 v1.5 RSA to prevent its use in possible Bleichenbacher timing attacks.
- Record
USN-6663-3- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensslUbuntu:24.04:LTS |
before 3.0.13-0ubuntu3.1, plus listed versions 3.0.10-1ubuntu23.0.10-1ubuntu2.13.0.10-1ubuntu33.0.10-1ubuntu43.0.13-0ubuntu23.0.13-0ubuntu3 |
3.0.13-0ubuntu3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6663-3 is a vulnerability with no CVSS score yet in openssl, published May 23, 2024. No source lists public exploit code. Fixed in openssl 3.0.13-0ubuntu3.1.