Red Hat Security AdvisoryRHSA-2012:0059
openssl security update
Released 2012-01-24 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.0-20.el6_2.1
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-1.0.0-20.el6_2.1, openssl-devel-1.0.0-20.el6_2.1, openssl-perl-1.0.0-20.el6_2.1 +1
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.0-20.el6_2.1
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-1.0.0-20.el6_2.1, openssl-devel-1.0.0-20.el6_2.1, openssl-perl-1.0.0-20.el6_2.1 +1
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.0-20.el6_2.1, openssl-1.0.0-20.el6_2.1.ppc, openssl-devel-1.0.0-20.el6_2.1 +1
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-1.0.0-20.el6_2.1, openssl-perl-1.0.0-20.el6_2.1, openssl-static-1.0.0-20.el6_2.1
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.0-20.el6_2.1, openssl-devel-1.0.0-20.el6_2.1
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-1.0.0-20.el6_2.1, openssl-perl-1.0.0-20.el6_2.1, openssl-static-1.0.0-20.el6_2.1
Fixes 4 records
Priority MEDIUM 40
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption)…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.17839 · Published 2012-01-06 · Partial fix CWE-399
Priority LOW 39
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decry…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.15575 · Published 2012-01-06 · Partial fix CWE-310
Priority LOW 36
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.1605 · Published 2012-01-06 · Partial fix CWE-310
Priority LOW 31
OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data assoc…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.08193 · Published 2012-01-06 · Fixed CWE-399
THREATIST.IORead the docs