Red Hat Security AdvisoryRHSA-2015:0066
openssl security update
Released 2015-01-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.1e-34.el7_0.7, openssl-libs-1:1.0.1e-34.el7_0.7
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.1e-34.el7_0.7, openssl-perl-1:1.0.1e-34.el7_0.7, openssl-static-1:1.0.1e-34.el7_0.7
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.1e-34.el7_0.7, openssl-libs-1:1.0.1e-34.el7_0.7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.1e-34.el7_0.7, openssl-perl-1:1.0.1e-34.el7_0.7, openssl-static-1:1.0.1e-34.el7_0.7
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.1e-30.el6_6.5
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-devel-1.0.1e-30.el6_6.5, openssl-perl-1.0.1e-30.el6_6.5, openssl-static-1.0.1e-30.el6_6.5
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.1e-30.el6_6.5
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-devel-1.0.1e-30.el6_6.5, openssl-perl-1.0.1e-30.el6_6.5, openssl-static-1.0.1e-30.el6_6.5
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.1e-30.el6_6.5, openssl-1.0.1e-30.el6_6.5.ppc, openssl-devel-1.0.1e-30.el6_6.5 +1
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.1e-34.el7_0.7, openssl-devel-1:1.0.1e-34.el7_0.7, openssl-devel-1:1.0.1e-34.el7_0.7.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-perl-1.0.1e-30.el6_6.5, openssl-static-1.0.1e-30.el6_6.5
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.1e-34.el7_0.7, openssl-static-1:1.0.1e-34.el7_0.7, openssl-static-1:1.0.1e-34.el7_0.7.ppc
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.1e-30.el6_6.5, openssl-devel-1.0.1e-30.el6_6.5
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.1e-34.el7_0.7, openssl-devel-1:1.0.1e-34.el7_0.7, openssl-libs-1:1.0.1e-34.el7_0.7
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-perl-1.0.1e-30.el6_6.5, openssl-static-1.0.1e-30.el6_6.5
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.1e-34.el7_0.7, openssl-static-1:1.0.1e-34.el7_0.7
Fixes 7 records
Priority HIGH 65
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.98685 · Published 2015-01-09 · Partial fix CWE-310
Priority MEDIUM 56
Memory leak in the dtls1_buffer_record function in d1_pkt.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (memory consumption) by sending many duplicate recor…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.5736 · Published 2015-01-09 · Partial fix CWE-119
Priority MEDIUM 43
The ssl3_get_cert_verify function in s3_srvr.c in OpenSSL 1.0.0 before 1.0.0p and 1.0.1 before 1.0.1k accepts client authentication with a Diffie-Hellman (DH) certificate without requiring a CertificateVerify message, wh…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.22341 · Published 2015-01-09 · Partial fix CWE-310
Priority MEDIUM 43
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.22133 · Published 2015-01-09 · Partial fix
Priority MEDIUM 42
The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat crypto…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.21869 · Published 2015-01-09 · Partial fix CWE-310
Priority LOW 39
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not enforce certain constraints on certificate data, which allows remote attackers to defeat a fingerprint-based certificate-blacklist protection…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.15033 · Published 2015-01-09 · Partial fix CWE-310
Priority LOW 32
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward s…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.06237 · Published 2015-01-09 · Partial fix CWE-310
THREATIST.IORead the docs