Red Hat Security AdvisoryRHSA-2015:0716
openssl security and bug fix update
Released 2015-03-23 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.1e-42.el7_1.4, openssl-libs-1:1.0.1e-42.el7_1.4
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.1e-42.el7_1.4, openssl-perl-1:1.0.1e-42.el7_1.4, openssl-static-1:1.0.1e-42.el7_1.4
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.1e-42.el7_1.4, openssl-libs-1:1.0.1e-42.el7_1.4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.1e-42.el7_1.4, openssl-perl-1:1.0.1e-42.el7_1.4, openssl-static-1:1.0.1e-42.el7_1.4
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.1e-42.ael7b_1.4, openssl-1:1.0.1e-42.el7_1.4, openssl-devel-1:1.0.1e-42.ael7b_1.4 +5
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.1e-42.ael7b_1.4, openssl-perl-1:1.0.1e-42.el7_1.4, openssl-static-1:1.0.1e-42.ael7b_1.4 +2
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.1e-42.el7_1.4, openssl-devel-1:1.0.1e-42.el7_1.4, openssl-libs-1:1.0.1e-42.el7_1.4
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.1e-42.el7_1.4, openssl-static-1:1.0.1e-42.el7_1.4
Fixes 9 records
Priority MEDIUM 61
Integer underflow in the EVP_DecodeUpdate function in crypto/evp/encode.c in the base64-decoding implementation in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a d…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.4253 · Published 2015-03-19 · Partial fix CWE-119
Priority MEDIUM 47
Use-after-free vulnerability in the d2i_ECPrivateKey function in crypto/ec/ec_asn1.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow remote attackers to cause a de…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.16401 · Published 2015-03-19 · Partial fix
Priority MEDIUM 42
The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.21247 · Published 2015-03-19 · Partial fix CWE-20
Priority MEDIUM 41
The ASN1_TYPE_cmp function in crypto/asn1/a_type.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly perform boolean-type comparisons, which allows remote atta…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.1988 · Published 2015-03-19 · Partial fix CWE-17
Priority LOW 36
An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorr…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.06903 · Published 2016-03-02 · Partial fix CWE-200
Priority LOW 35
The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGT…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.05398 · Published 2016-03-02 · Partial fix CWE-200
Priority LOW 34
The PKCS#7 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not properly handle a lack of outer ContentInfo, which allows attackers to cause a denial of ser…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.08599 · Published 2015-03-19 · Partial fix
Priority LOW 34
The X509_to_X509_REQ function in crypto/x509/x509_req.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a might allow attackers to cause a denial of service (NULL pointer derefe…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.08303 · Published 2015-03-19 · Partial fix
Priority LOW 34
The ASN1_item_ex_d2i function in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a does not reinitialize CHOICE and ADB data structures, which might allow…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.08599 · Published 2015-03-19 · Partial fix CWE-17
THREATIST.IORead the docs