Red Hat Security AdvisoryRHSA-2014:0015
openssl security update
Released 2014-01-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.1e-16.el6_5.4
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-1.0.1e-16.el6_5.4, openssl-devel-1.0.1e-16.el6_5.4, openssl-perl-1.0.1e-16.el6_5.4 +1
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.1e-16.el6_5.4
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-1.0.1e-16.el6_5.4, openssl-devel-1.0.1e-16.el6_5.4, openssl-perl-1.0.1e-16.el6_5.4 +1
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.1e-16.el6_5.4, openssl-1.0.1e-16.el6_5.4.ppc, openssl-devel-1.0.1e-16.el6_5.4 +1
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-1.0.1e-16.el6_5.4, openssl-perl-1.0.1e-16.el6_5.4, openssl-static-1.0.1e-16.el6_5.4
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.1e-16.el6_5.4, openssl-devel-1.0.1e-16.el6_5.4
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-1.0.1e-16.el6_5.4, openssl-perl-1.0.1e-16.el6_5.4, openssl-static-1.0.1e-16.el6_5.4
Fixes 3 records
Priority MEDIUM 42
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers t…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.15345 · Published 2014-01-01 · Fixed CWE-310
Priority LOW 39
The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via cra…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.21174 · Published 2013-12-23 · Fixed CWE-310
Priority LOW 34
The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation r…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.11851 · Published 2014-01-09 · Fixed CWE-20
THREATIST.IORead the docs