Red Hat Security AdvisoryRHSA-2014:0624
openssl security update
Released 2014-06-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) openssl-0.9.8e-27.el5_10.3, openssl-0.9.8e-27.el5_10.3.i386, openssl-0.9.8e-27.el5_10.3.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 5 client) openssl-0.9.8e-27.el5_10.3, openssl-0.9.8e-27.el5_10.3.i386, openssl-perl-0.9.8e-27.el5_10.3 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) openssl-0.9.8e-27.el5_10.3, openssl-devel-0.9.8e-27.el5_10.3, openssl-devel-0.9.8e-27.el5_10.3.i386
Fixes 1 record
Priority HIGH 76
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key…
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.95326 · Published 2014-06-05 · Partial fix CWE-326
