Red Hat Security Advisory

RHSA-2014:1053

openssl security update

Released 2014-08-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) openssl-0.9.8e-27.el5_10.4, openssl-0.9.8e-27.el5_10.4.i386, openssl-0.9.8e-27.el5_10.4.ia64 +9
Red Hat Enterprise Linux Desktop (v. 5 client) openssl-0.9.8e-27.el5_10.4, openssl-0.9.8e-27.el5_10.4.i386, openssl-perl-0.9.8e-27.el5_10.4 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) openssl-0.9.8e-27.el5_10.4, openssl-devel-0.9.8e-27.el5_10.4, openssl-devel-0.9.8e-27.el5_10.4.i386

Fixes 5 records

TI-2014-00214 CVE-2014-0221 · GHSA-72w7-m73m-gc5c

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0…

MEDIUM 62

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS he…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.87892 Published 2014-06-05 Partial fix

TI-2014-02833 CVE-2014-3506 · GHSA-9x6f-2q3g-8x4r

d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before…

MEDIUM 53

d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake mess…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.46124 Published 2014-08-13 Partial fix CWE-399

TI-2014-02832 CVE-2014-3505 · GHSA-fw22-2v92-6x57

Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before…

MEDIUM 53

Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.46124 Published 2014-08-13 Partial fix

TI-2014-02835 CVE-2014-3508 · GHSA-5fxv-32q4-g2fh

The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb…

MEDIUM 41

The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which all…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.24521 Published 2014-08-13 Partial fix CWE-200

TI-2014-02837 CVE-2014-3510 · GHSA-5ww9-48wf-v8p8

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb…

LOW 38

The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.18366 Published 2014-08-13 Partial fix