Red Hat Security AdvisoryRHSA-2012:0426
openssl security and bug fix update
Released 2012-03-27 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHEL Desktop Workstation (v. 5 client) openssl-0.9.8e-22.el5_8.1, openssl-devel-0.9.8e-22.el5_8.1, openssl-devel-0.9.8e-22.el5_8.1.i386
- Red Hat Enterprise Linux (v. 5 server) openssl-0.9.8e-22.el5_8.1, openssl-0.9.8e-22.el5_8.1.i386, openssl-0.9.8e-22.el5_8.1.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 5 client) openssl-0.9.8e-22.el5_8.1, openssl-0.9.8e-22.el5_8.1.i386, openssl-perl-0.9.8e-22.el5_8.1 +1
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.0-20.el6_2.3
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-1.0.0-20.el6_2.3, openssl-devel-1.0.0-20.el6_2.3, openssl-perl-1.0.0-20.el6_2.3 +1
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.0-20.el6_2.3
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-1.0.0-20.el6_2.3, openssl-devel-1.0.0-20.el6_2.3, openssl-perl-1.0.0-20.el6_2.3 +1
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.0-20.el6_2.3, openssl-1.0.0-20.el6_2.3.ppc, openssl-devel-1.0.0-20.el6_2.3 +1
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-1.0.0-20.el6_2.3, openssl-perl-1.0.0-20.el6_2.3, openssl-static-1.0.0-20.el6_2.3
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.0-20.el6_2.3, openssl-devel-1.0.0-20.el6_2.3
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-1.0.0-20.el6_2.3, openssl-perl-1.0.0-20.el6_2.3, openssl-static-1.0.0-20.el6_2.3
Fixes 2 records
Priority LOW 37
The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attacker…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.13176 · Published 2012-03-13 · Partial fix CWE-310
Priority LOW 32
The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/M…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.06525 · Published 2012-03-15 · Partial fix CWE-399
