Red Hat Security AdvisoryRHSA-2014:0626
openssl097a and openssl098e security update
Released 2014-06-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) openssl097a-0.9.7a-12.el5_10.1, openssl097a-0.9.7a-12.el5_10.1.i386, openssl097a-0.9.7a-12.el5_10.1.ia64 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) openssl097a-0.9.7a-12.el5_10.1, openssl097a-0.9.7a-12.el5_10.1.i386
- Red Hat Enterprise Linux Desktop (v. 6) openssl098e-0.9.8e-18.el6_5.2
- Red Hat Enterprise Linux HPC Node (v. 6) openssl098e-0.9.8e-18.el6_5.2
- Red Hat Enterprise Linux Server (v. 6) openssl098e-0.9.8e-18.el6_5.2, openssl098e-0.9.8e-18.el6_5.2.ppc
- Red Hat Enterprise Linux Workstation (v. 6) openssl098e-0.9.8e-18.el6_5.2
Fixes 1 record
Priority HIGH 76
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key…
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.95326 · Published 2014-06-05 · Partial fix CWE-326
