Red Hat Security AdvisoryRHSA-2014:0627
openssl security update
Released 2014-06-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AS (v. 4 ELS) openssl-0.9.7a-43.22.el4, openssl-0.9.7a-43.22.el4.i386, openssl-0.9.7a-43.22.el4.ia64 +6
- Red Hat Enterprise Linux Compute Node EUS (v. 6.3) openssl-1.0.0-25.el6_3.3
- Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.3) openssl-1.0.0-25.el6_3.3, openssl-devel-1.0.0-25.el6_3.3, openssl-perl-1.0.0-25.el6_3.3 +1
- Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) openssl-1.0.0-27.el6_4.4, openssl-devel-1.0.0-27.el6_4.4, openssl-perl-1.0.0-27.el6_4.4 +1
- Red Hat Enterprise Linux ES (v. 4 ELS) openssl-0.9.7a-43.22.el4, openssl-0.9.7a-43.22.el4.i386, openssl-devel-0.9.7a-43.22.el4 +3
- Red Hat Enterprise Linux EUS (v. 5.9 server) openssl-0.9.8e-26.el5_9.4, openssl-0.9.8e-26.el5_9.4.i386, openssl-0.9.8e-26.el5_9.4.ia64 +9
- Red Hat Enterprise Linux HPC Node EUS (v. 6.4) openssl-1.0.0-27.el6_4.4
- Red Hat Enterprise Linux Long Life (v. 5.6 server) openssl-0.9.8e-12.el5_6.12, openssl-0.9.8e-12.el5_6.12.i386, openssl-0.9.8e-12.el5_6.12.ia64 +6
- Red Hat Enterprise Linux Server AUS (v. 6.2) openssl-1.0.0-20.el6_2.7, openssl-devel-1.0.0-20.el6_2.7
- Red Hat Enterprise Linux Server EUS (v. 6.3) openssl-1.0.0-25.el6_3.3, openssl-1.0.0-25.el6_3.3.ppc, openssl-devel-1.0.0-25.el6_3.3 +1
- Red Hat Enterprise Linux Server EUS (v. 6.4) openssl-1.0.0-27.el6_4.4, openssl-1.0.0-27.el6_4.4.ppc, openssl-devel-1.0.0-27.el6_4.4 +1
- Red Hat Enterprise Linux Server Optional AUS (v. 6.2) openssl-1.0.0-20.el6_2.7, openssl-perl-1.0.0-20.el6_2.7, openssl-static-1.0.0-20.el6_2.7
- Red Hat Enterprise Linux Server Optional EUS (v. 6.3) openssl-1.0.0-25.el6_3.3, openssl-perl-1.0.0-25.el6_3.3, openssl-static-1.0.0-25.el6_3.3
- Red Hat Enterprise Linux Server Optional EUS (v. 6.4) openssl-1.0.0-27.el6_4.4, openssl-perl-1.0.0-27.el6_4.4, openssl-static-1.0.0-27.el6_4.4
Fixes 1 record
Priority HIGH 76
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key…
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.95326 · Published 2014-06-05 · Partial fix CWE-326
