Red Hat Security AdvisoryRHSA-2015:2617
openssl security update
Released 2015-12-14 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.1e-51.el7_2.1, openssl-libs-1:1.0.1e-51.el7_2.1
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.1e-51.el7_2.1, openssl-perl-1:1.0.1e-51.el7_2.1, openssl-static-1:1.0.1e-51.el7_2.1
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.1e-51.el7_2.1, openssl-libs-1:1.0.1e-51.el7_2.1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.1e-51.el7_2.1, openssl-perl-1:1.0.1e-51.el7_2.1, openssl-static-1:1.0.1e-51.el7_2.1
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.1e-42.el6_7.1
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-devel-1.0.1e-42.el6_7.1, openssl-perl-1.0.1e-42.el6_7.1, openssl-static-1.0.1e-42.el6_7.1
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.1e-42.el6_7.1
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-devel-1.0.1e-42.el6_7.1, openssl-perl-1.0.1e-42.el6_7.1, openssl-static-1.0.1e-42.el6_7.1
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.1e-42.el6_7.1, openssl-1.0.1e-42.el6_7.1.ppc, openssl-devel-1.0.1e-42.el6_7.1 +1
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.1e-51.el7_2.1, openssl-devel-1:1.0.1e-51.el7_2.1, openssl-devel-1:1.0.1e-51.el7_2.1.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-perl-1.0.1e-42.el6_7.1, openssl-static-1.0.1e-42.el6_7.1
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.1e-51.el7_2.1, openssl-static-1:1.0.1e-51.el7_2.1, openssl-static-1:1.0.1e-51.el7_2.1.ppc
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.1e-42.el6_7.1, openssl-devel-1.0.1e-42.el6_7.1
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.1e-51.el7_2.1, openssl-devel-1:1.0.1e-51.el7_2.1, openssl-libs-1:1.0.1e-51.el7_2.1
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-perl-1.0.1e-42.el6_7.1, openssl-static-1.0.1e-42.el6_7.1
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.1e-51.el7_2.1, openssl-static-1:1.0.1e-51.el7_2.1
Fixes 3 records
Priority MEDIUM 62
crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lack…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.44016 · Published 2015-12-06 · Partial fix CWE-476
Priority MEDIUM 51
The ASN1_TFLG_COMBINE implementation in crypto/asn1/tasn_dec.c in OpenSSL before 0.9.8zh, 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1q, and 1.0.2 before 1.0.2e mishandles errors caused by malformed X509_ATTRIBUTE data, which…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.38709 · Published 2015-12-06 · Partial fix CWE-200
Priority LOW 35
ssl/s3_clnt.c in OpenSSL 1.0.0 before 1.0.0t, 1.0.1 before 1.0.1p, and 1.0.2 before 1.0.2d, when used for a multi-threaded client, writes the PSK identity hint to an incorrect data structure, which allows remote servers…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.13527 · Published 2015-12-06 · Partial fix CWE-362
THREATIST.IORead the docs