Red Hat Security AdvisoryRHSA-2014:1052
openssl security update
Released 2014-08-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.1e-34.el7_0.4, openssl-libs-1:1.0.1e-34.el7_0.4
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.1e-34.el7_0.4, openssl-perl-1:1.0.1e-34.el7_0.4, openssl-static-1:1.0.1e-34.el7_0.4
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.1e-34.el7_0.4, openssl-libs-1:1.0.1e-34.el7_0.4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.1e-34.el7_0.4, openssl-perl-1:1.0.1e-34.el7_0.4, openssl-static-1:1.0.1e-34.el7_0.4
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.1e-16.el6_5.15
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-1.0.1e-16.el6_5.15, openssl-devel-1.0.1e-16.el6_5.15, openssl-perl-1.0.1e-16.el6_5.15 +1
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.1e-16.el6_5.15
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-1.0.1e-16.el6_5.15, openssl-devel-1.0.1e-16.el6_5.15, openssl-perl-1.0.1e-16.el6_5.15 +1
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.1e-16.el6_5.15, openssl-1.0.1e-16.el6_5.15.ppc, openssl-devel-1.0.1e-16.el6_5.15 +1
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.1e-34.el7_0.4, openssl-devel-1:1.0.1e-34.el7_0.4, openssl-devel-1:1.0.1e-34.el7_0.4.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-1.0.1e-16.el6_5.15, openssl-perl-1.0.1e-16.el6_5.15, openssl-static-1.0.1e-16.el6_5.15
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.1e-34.el7_0.4, openssl-static-1:1.0.1e-34.el7_0.4, openssl-static-1:1.0.1e-34.el7_0.4.ppc
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.1e-16.el6_5.15, openssl-devel-1.0.1e-16.el6_5.15
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.1e-34.el7_0.4, openssl-devel-1:1.0.1e-34.el7_0.4, openssl-libs-1:1.0.1e-34.el7_0.4
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-1.0.1e-16.el6_5.15, openssl-perl-1.0.1e-16.el6_5.15, openssl-static-1.0.1e-16.el6_5.15
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.1e-34.el7_0.4, openssl-static-1:1.0.1e-34.el7_0.4
Fixes 7 records
Priority MEDIUM 55
Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.54276 · Published 2014-08-13 · Partial fix CWE-399
Priority MEDIUM 53
d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake mess…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.46124 · Published 2014-08-13 · Partial fix CWE-399
Priority MEDIUM 53
Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.46124 · Published 2014-08-13 · Partial fix
Priority MEDIUM 44
Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a de…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.12911 · Published 2014-08-13 · Fixed CWE-362
Priority MEDIUM 41
The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which all…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.24521 · Published 2014-08-13 · Partial fix CWE-200
Priority LOW 38
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.18366 · Published 2014-08-13 · Partial fix
Priority LOW 35
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a c…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.14129 · Published 2014-08-13 · Fixed
THREATIST.IORead the docs