Red Hat Security AdvisoryRHSA-2010:0977
openssl security update
Released 2010-12-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AS version 4 openssl-0.9.7a-43.17.el4_8.6, openssl-0.9.7a-43.17.el4_8.6.i386, openssl-0.9.7a-43.17.el4_8.6.ia64 +9
- Red Hat Enterprise Linux Desktop version 4 openssl-0.9.7a-43.17.el4_8.6, openssl-0.9.7a-43.17.el4_8.6.i386, openssl-devel-0.9.7a-43.17.el4_8.6 +3
- Red Hat Enterprise Linux ES version 4 openssl-0.9.7a-43.17.el4_8.6, openssl-0.9.7a-43.17.el4_8.6.i386, openssl-0.9.7a-43.17.el4_8.6.ia64 +6
- Red Hat Enterprise Linux WS version 4 openssl-0.9.7a-43.17.el4_8.6, openssl-0.9.7a-43.17.el4_8.6.i386, openssl-0.9.7a-43.17.el4_8.6.ia64 +6
Fixes 3 records
Priority MEDIUM 52
OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified i…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.05779 · Published 2010-03-05 · Fixed CWE-20
Priority LOW 32
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to fo…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.09497 · Published 2010-12-06 · Partial fix
Priority LOW 26
OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher v…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.03426 · Published 2010-12-06 · Partial fix CWE-310
THREATIST.IORead the docs