Red Hat Security AdvisoryRHSA-2015:1197
openssl security update
Released 2015-06-30 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) openssl-0.9.8e-36.el5_11, openssl-0.9.8e-36.el5_11.i386, openssl-0.9.8e-36.el5_11.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 5 client) openssl-0.9.8e-36.el5_11, openssl-0.9.8e-36.el5_11.i386, openssl-perl-0.9.8e-36.el5_11 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) openssl-0.9.8e-36.el5_11, openssl-devel-0.9.8e-36.el5_11, openssl-devel-0.9.8e-36.el5_11.i386
Fixes 3 records
Priority HIGH 72
The X509_cmp_time function in crypto/x509/x509_vfy.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (out-of-bounds read a…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.75724 · Published 2015-06-12 · Partial fix CWE-119
Priority MEDIUM 63
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgra…
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.9986 · Published 2015-05-21 · Partial fix CWE-295
Priority MEDIUM 43
The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dere…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.23953 · Published 2015-06-12 · Partial fix
THREATIST.IORead the docs