Red Hat Security AdvisoryRHSA-2013:0587
openssl security update
Released 2013-03-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) openssl-0.9.8e-26.el5_9.1, openssl-0.9.8e-26.el5_9.1.i386, openssl-0.9.8e-26.el5_9.1.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.0-27.el6_4.2
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-1.0.0-27.el6_4.2, openssl-devel-1.0.0-27.el6_4.2, openssl-perl-1.0.0-27.el6_4.2 +1
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.0-27.el6_4.2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-1.0.0-27.el6_4.2, openssl-devel-1.0.0-27.el6_4.2, openssl-perl-1.0.0-27.el6_4.2 +1
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.0-27.el6_4.2, openssl-1.0.0-27.el6_4.2.ppc, openssl-devel-1.0.0-27.el6_4.2 +1
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-1.0.0-27.el6_4.2, openssl-perl-1.0.0-27.el6_4.2, openssl-static-1.0.0-27.el6_4.2
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.0-27.el6_4.2, openssl-devel-1.0.0-27.el6_4.2
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-1.0.0-27.el6_4.2, openssl-perl-1.0.0-27.el6_4.2, openssl-static-1.0.0-27.el6_4.2
Fixes 3 records
Priority MEDIUM 41
OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer derefer…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.1965 · Published 2013-02-08 · Partial fix CWE-310
Priority LOW 39
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the proces…
CVSS 2.0LOW 2.6· Network · No auth · Interaction — · EPSS 0.35584 · Published 2013-02-08 · Partial fix CWE-310
Priority LOW 20
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-mi…
CVSS 2.0LOW 2.6· Network · No auth · Interaction — · EPSS 0.04346 · Published 2012-09-15 · Partial fix CWE-310
THREATIST.IORead the docs