Red Hat Security AdvisoryRHSA-2016:0302
openssl security update
Released 2016-03-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) openssl-0.9.8e-39.el5_11, openssl-0.9.8e-39.el5_11.i386, openssl-0.9.8e-39.el5_11.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 5 client) openssl-0.9.8e-39.el5_11, openssl-0.9.8e-39.el5_11.i386, openssl-perl-0.9.8e-39.el5_11 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) openssl-0.9.8e-39.el5_11, openssl-devel-0.9.8e-39.el5_11, openssl-devel-0.9.8e-39.el5_11.i386
Fixes 3 records
Priority HIGH 67
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, wh…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.82112 · Published 2016-03-01 · Partial fix CWE-200
Priority MEDIUM 55
Multiple integer overflows in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g allow remote attackers to cause a denial of service (heap memory corruption or NULL pointer dereference) or possibly have unspecified othe…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.27022 · Published 2016-03-03 · Partial fix
Priority LOW 39
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by perfor…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.10731 · Published 2016-02-15 · Partial fix CWE-200
THREATIST.IORead the docs