Red Hat Security Advisory

RHSA-2012:0060

openssl security update

Released 2012-01-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHEL Desktop Workstation (v. 5 client) openssl-0.9.8e-20.el5_7.1, openssl-devel-0.9.8e-20.el5_7.1, openssl-devel-0.9.8e-20.el5_7.1.i386
Red Hat Enterprise Linux (v. 5 server) openssl-0.9.8e-20.el5_7.1, openssl-0.9.8e-20.el5_7.1.i386, openssl-0.9.8e-20.el5_7.1.ia64 +9
Red Hat Enterprise Linux Desktop (v. 5 client) openssl-0.9.8e-20.el5_7.1, openssl-0.9.8e-20.el5_7.1.i386, openssl-perl-0.9.8e-20.el5_7.1 +1

Fixes 4 records

TI-2011-03627 CVE-2011-4109 · GHSA-fr6r-xw3f-g957

Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK…

MEDIUM 57

Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.1691 Published 2012-01-06 Partial fix CWE-399

TI-2011-03985 CVE-2011-4619 · GHSA-9866-p82r-56gj

The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x…

MEDIUM 40

The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption)…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.17839 Published 2012-01-06 Partial fix CWE-399

TI-2011-03942 CVE-2011-4576 · GHSA-cr84-m7vr-7v6v

The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not…

LOW 39

The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decry…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.15575 Published 2012-01-06 Partial fix CWE-310

TI-2011-03626 CVE-2011-4108 · GHSA-g8h7-34h7-3c73

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC…

LOW 36

The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.1605 Published 2012-01-06 Partial fix CWE-310