Red Hat Security AdvisoryRHSA-2016:0303
openssl security update
Released 2016-03-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server AUS (v. 6.2) openssl-1.0.0-20.el6_2.8, openssl-devel-1.0.0-20.el6_2.8
- Red Hat Enterprise Linux Server AUS (v. 6.4) openssl-1.0.0-27.el6_4.5, openssl-devel-1.0.0-27.el6_4.5
- Red Hat Enterprise Linux Server AUS (v. 6.5) openssl-1.0.1e-16.el6_5.16, openssl-devel-1.0.1e-16.el6_5.16
- Red Hat Enterprise Linux Server Optional AUS (v. 6.2) openssl-1.0.0-20.el6_2.8, openssl-perl-1.0.0-20.el6_2.8, openssl-static-1.0.0-20.el6_2.8
- Red Hat Enterprise Linux Server Optional AUS (v. 6.4) openssl-1.0.0-27.el6_4.5, openssl-perl-1.0.0-27.el6_4.5, openssl-static-1.0.0-27.el6_4.5
- Red Hat Enterprise Linux Server Optional AUS (v. 6.5) openssl-1.0.1e-16.el6_5.16, openssl-perl-1.0.1e-16.el6_5.16, openssl-static-1.0.1e-16.el6_5.16
Fixes 5 records
Priority HIGH 67
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, wh…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.82112 · Published 2016-03-01 · Partial fix CWE-200
Priority MEDIUM 42
The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.21247 · Published 2015-03-19 · Partial fix CWE-20
Priority LOW 39
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by perfor…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.10731 · Published 2016-02-15 · Partial fix CWE-200
Priority LOW 36
An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorr…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.06903 · Published 2016-03-02 · Partial fix CWE-200
Priority LOW 35
The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGT…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.05398 · Published 2016-03-02 · Partial fix CWE-200
THREATIST.IORead the docs