Red Hat Security AdvisoryRHSA-2015:1115
openssl security update
Released 2015-06-15 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.1e-42.el7_1.8, openssl-libs-1:1.0.1e-42.el7_1.8
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.1e-42.el7_1.8, openssl-perl-1:1.0.1e-42.el7_1.8, openssl-static-1:1.0.1e-42.el7_1.8
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.1e-42.el7_1.8, openssl-libs-1:1.0.1e-42.el7_1.8
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.1e-42.el7_1.8, openssl-perl-1:1.0.1e-42.el7_1.8, openssl-static-1:1.0.1e-42.el7_1.8
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.1e-30.el6_6.11
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-devel-1.0.1e-30.el6_6.11, openssl-perl-1.0.1e-30.el6_6.11, openssl-static-1.0.1e-30.el6_6.11
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.1e-30.el6_6.11
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-devel-1.0.1e-30.el6_6.11, openssl-perl-1.0.1e-30.el6_6.11, openssl-static-1.0.1e-30.el6_6.11
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.1e-30.el6_6.11, openssl-1.0.1e-30.el6_6.11.ppc, openssl-devel-1.0.1e-30.el6_6.11 +1
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.1e-42.ael7b_1.8, openssl-1:1.0.1e-42.el7_1.8, openssl-devel-1:1.0.1e-42.ael7b_1.8 +5
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-perl-1.0.1e-30.el6_6.11, openssl-static-1.0.1e-30.el6_6.11
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.1e-42.ael7b_1.8, openssl-perl-1:1.0.1e-42.el7_1.8, openssl-static-1:1.0.1e-42.ael7b_1.8 +2
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.1e-30.el6_6.11, openssl-devel-1.0.1e-30.el6_6.11
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.1e-42.el7_1.8, openssl-devel-1:1.0.1e-42.el7_1.8, openssl-libs-1:1.0.1e-42.el7_1.8
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-perl-1.0.1e-30.el6_6.11, openssl-static-1.0.1e-30.el6_6.11
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.1e-42.el7_1.8, openssl-static-1:1.0.1e-42.el7_1.8
Fixes 6 records
Priority HIGH 72
The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read a…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.75724 · Published 2015-06-12 · Partial fix CWE-119
Priority MEDIUM 50
The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpe…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.16587 · Published 2015-06-12 · Partial fix CWE-119
Priority MEDIUM 47
Race condition in the ssl3_get_new_session_ticket function in ssl/s3_clnt.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b, when used for a multi-threaded client, allows remo…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.1673 · Published 2015-06-12 · Partial fix CWE-362
Priority MEDIUM 43
The do_free_upto function in crypto/cms/cms_smime.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (infinite loop) via ve…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.229 · Published 2015-06-12 · Partial fix CWE-399
Priority MEDIUM 43
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dere…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.23953 · Published 2015-06-12 · Partial fix
Priority LOW 27
Race condition in a certain Red Hat patch to the PRNG lock implementation in the ssleay_rand_bytes function in OpenSSL, as distributed in openssl-1.0.1e-25.el7 in Red Hat Enterprise Linux (RHEL) 7 and other products, all…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.04272 · Published 2015-07-07 · Partial fix CWE-189
THREATIST.IORead the docs