Red Hat Security AdvisoryRHSA-2016:0301
openssl security update
Released 2016-03-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.1e-51.el7_2.4, openssl-libs-1:1.0.1e-51.el7_2.4
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.1e-51.el7_2.4, openssl-perl-1:1.0.1e-51.el7_2.4, openssl-static-1:1.0.1e-51.el7_2.4
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.1e-51.el7_2.4, openssl-libs-1:1.0.1e-51.el7_2.4
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.1e-51.el7_2.4, openssl-perl-1:1.0.1e-51.el7_2.4, openssl-static-1:1.0.1e-51.el7_2.4
- Red Hat Enterprise Linux Desktop (v. 6) openssl-1.0.1e-42.el6_7.4
- Red Hat Enterprise Linux Desktop Optional (v. 6) openssl-devel-1.0.1e-42.el6_7.4, openssl-perl-1.0.1e-42.el6_7.4, openssl-static-1.0.1e-42.el6_7.4
- Red Hat Enterprise Linux HPC Node (v. 6) openssl-1.0.1e-42.el6_7.4
- Red Hat Enterprise Linux HPC Node Optional (v. 6) openssl-devel-1.0.1e-42.el6_7.4, openssl-perl-1.0.1e-42.el6_7.4, openssl-static-1.0.1e-42.el6_7.4
- Red Hat Enterprise Linux Server (v. 6) openssl-1.0.1e-42.el6_7.4, openssl-1.0.1e-42.el6_7.4.ppc, openssl-devel-1.0.1e-42.el6_7.4 +1
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.1e-51.el7_2.4, openssl-devel-1:1.0.1e-51.el7_2.4, openssl-devel-1:1.0.1e-51.el7_2.4.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 6) openssl-perl-1.0.1e-42.el6_7.4, openssl-static-1.0.1e-42.el6_7.4
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.1e-51.el7_2.4, openssl-static-1:1.0.1e-51.el7_2.4, openssl-static-1:1.0.1e-51.el7_2.4.ppc
- Red Hat Enterprise Linux Workstation (v. 6) openssl-1.0.1e-42.el6_7.4, openssl-devel-1.0.1e-42.el6_7.4
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.1e-51.el7_2.4, openssl-devel-1:1.0.1e-51.el7_2.4, openssl-libs-1:1.0.1e-51.el7_2.4
- Red Hat Enterprise Linux Workstation Optional (v. 6) openssl-perl-1.0.1e-42.el6_7.4, openssl-static-1.0.1e-42.el6_7.4
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.1e-51.el7_2.4, openssl-static-1:1.0.1e-51.el7_2.4
Fixes 5 records
Priority HIGH 67
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, wh…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.82112 · Published 2016-03-01 · Partial fix CWE-200
Priority MEDIUM 64
Double free vulnerability in the dsa_priv_decode function in crypto/dsa/dsa_ameth.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allows remote attackers to cause a denial of service (memory corruption) or possi…
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.26335 · Published 2016-03-03 · Partial fix
Priority MEDIUM 55
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified othe…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.27022 · Published 2016-03-03 · Partial fix
Priority LOW 39
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by perfor…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.10731 · Published 2016-02-15 · Partial fix CWE-200
Priority LOW 27
The MOD_EXP_CTIME_COPY_FROM_PREBUF function in crypto/bn/bn_exp.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not properly consider cache-bank access times during modular exponentiation, which makes it ea…
CVSS 3.1MEDIUM 5.1· Local · No auth · No interaction · EPSS 0.0191 · Published 2016-03-03 · Partial fix CWE-200
THREATIST.IORead the docs