Red Hat Security AdvisoryRHSA-2014:0625
openssl security update
Released 2014-06-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.1e-16.el6_5.14
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-1.0.1e-16.el6_5.14, openssl-devel-1.0.1e-16.el6_5.14, openssl-perl-1.0.1e-16.el6_5.14 +1
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.1e-16.el6_5.14
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-1.0.1e-16.el6_5.14, openssl-devel-1.0.1e-16.el6_5.14, openssl-perl-1.0.1e-16.el6_5.14 +1
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.1e-16.el6_5.14, openssl-1.0.1e-16.el6_5.14.ppc, openssl-devel-1.0.1e-16.el6_5.14 +1
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-1.0.1e-16.el6_5.14, openssl-perl-1.0.1e-16.el6_5.14, openssl-static-1.0.1e-16.el6_5.14
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.1e-16.el6_5.14, openssl-devel-1.0.1e-16.el6_5.14
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-1.0.1e-16.el6_5.14, openssl-perl-1.0.1e-16.el6_5.14, openssl-static-1.0.1e-16.el6_5.14
Fixes 6 records
Priority HIGH 76
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key…
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.95326 · Published 2014-06-05 · Partial fix CWE-326
Priority HIGH 75
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote at…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.99977 · Published 2014-06-05 · Fixed CWE-120
Priority MEDIUM 62
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of s…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.85784 · Published 2014-06-05 · Fixed CWE-476
Priority MEDIUM 62
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS he…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.87892 · Published 2014-06-05 · Partial fix
Priority MEDIUM 48
The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to c…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.4031 · Published 2014-05-06 · Fixed CWE-476
Priority MEDIUM 44
Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-aft…
CVSS 2.0MEDIUM 4.0· Network · No auth · Interaction — · EPSS 0.34132 · Published 2014-04-14 · Fixed CWE-362
THREATIST.IORead the docs