9

The error message you seeing is indicating that my system has not been updated to the latest version of OpenSSL, which includes a fix for the CVE-2023-2650 vulnerability. how To fix this:

Hit:1 http://us.archive.ubuntu.com/ubuntu jammy InRelease                                                           
Hit:2 http://us.archive.ubuntu.com/ubuntu jammy-updates InRelease                                                                                     
Hit:3 https://dl.google.com/linux/chrome/deb stable InRelease                                                                                         
Hit:4 https://packages.microsoft.com/repos/edge stable InRelease                                                                
Hit:5 http://us.archive.ubuntu.com/ubuntu jammy-backports InRelease 
Hit:6 https://esm.ubuntu.com/cis/ubuntu jammy InRelease
Hit:7 http://us.archive.ubuntu.com/ubuntu jammy-security InRelease
Hit:8 https://esm.ubuntu.com/apps/ubuntu jammy-apps-security InRelease
Hit:9 https://esm.ubuntu.com/apps/ubuntu jammy-apps-updates InRelease
Hit:10 https://esm.ubuntu.com/infra/ubuntu jammy-infra-security InRelease
Hit:11 https://esm.ubuntu.com/infra/ubuntu jammy-infra-updates InRelease
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
4 packages can be upgraded. Run 'apt list --upgradable' to see them.
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
#
# An OpenSSL vulnerability has recently been fixed with USN-6188-1 & 6119-1:
# CVE-2023-2650: possible DoS translating ASN.1 object identifiers.
# Ensure you have updated the package to its latest version.
#
The following packages have been kept back:
  libspeechd2 speech-dispatcher speech-dispatcher-audio-plugins speech-dispatcher-espeak-ng
0 upgraded, 0 newly installed, 0 to remove and 4 not upgraded.

openssl version:

OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
Hossam Nabil
  • 99

2 Answers2

3

Your assumptions are unfortunately wrong. Let me decipher the message for you.

# An OpenSSL vulnerability has recently been fixed with USN-6188-1 & 6119-1:
# CVE-2023-2650: possible DoS translating ASN.1 object identifiers.
# Ensure you have updated the package to its latest version.

This is a service message telling you that there is a security update for OpenSSL. It's not an error, warning or anything like that at all.

The following packages have been kept back:
  libspeechd2 speech-dispatcher speech-dispatcher-audio-plugins speech-dispatcher-espeak-ng
0 upgraded, 0 newly installed, 0 to remove and 4 not upgraded.

Since there is 4 packages held back, and none to be upgraded, it's evident that OpenSSL is already upgraded to the latest version.

If you run apt policy openssl you'll get:

openssl:
  Installed: 3.0.2-0ubuntu1.10 
  Candidate: 3.0.2-0ubuntu1.10
  Version table: 
  ...

This is the latest upgraded version (as of August 2023).

The apt message is only a service, known as "APT News". To remove those messages, see this Q&A.

Artur Meinild
  • 31,035
1

This is still popping up for me. If you know the patched version (3.0.2-0ubuntu1.10), you can check your installed version with apt list openssl:

openssl/jammy-security,jammy-updates,now 3.0.2-0ubuntu1.10 amd64 [installed]

I haven't been able to get the warning to go away when I run sudo apt upgrade, but you can run sudo pro fix CVE-2023-2650 to check if you have any other vulnerable packages:

CVE-2023-2650: OpenSSL vulnerability
 - https://ubuntu.com/security/CVE-2023-2650

No affected source packages are installed.


✔ CVE-2023-2650 does not affect your system.
GammaGames
  • 382