USN-8847-2: OpenSSL vulnerabilities
Ubuntu USN-8847-2 backports OpenSSL fixes for a CRL denial-of-service bug and a timing side-channel to ESM 14.04-20.04 LTS.
USN-8847-2 provides the fixes from USN-8847-1 for OpenSSL on Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS. CVE-2026-35189 stems from incorrect handling of certificate revocation list distribution point names, allowing an attacker to cause excessive memory consumption and denial of service. A second flaw in scalar multiplication for non-NIST elliptic curves could enable a timing side-channel attack exposing sensitive information.
- Fixes apply to Ubuntu 14.04, 16.04, 18.04, and 20.04 LTS (ESM)
- CVE-2026-35189: CRL distribution point mishandling enables memory-exhaustion denial of service
- Non-NIST curve scalar multiplication flaw enables timing side-channel information disclosure
- CVEs
- CVE-2026-35189
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-35189 | OpenSSL memory-growth DoS via crafted CRL distribution points | 5.3 | — |
From the original article
USN-8847-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding fix for OpenSSL on Ubuntu 14. 04 LTS, Ubuntu 16.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.