Red Hat Security AdvisoryRHSA-2016:0305
openssl security update
Released 2016-03-01 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.1) openssl-1:1.0.1e-42.el7_1.10, openssl-libs-1:1.0.1e-42.el7_1.10
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.1) openssl-devel-1:1.0.1e-42.el7_1.10, openssl-perl-1:1.0.1e-42.el7_1.10, openssl-static-1:1.0.1e-42.el7_1.10
- Red Hat Enterprise Linux HPC Node EUS (v. 6.6) openssl-1.0.1e-30.el6_6.12
- Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.6) openssl-devel-1.0.1e-30.el6_6.12, openssl-perl-1.0.1e-30.el6_6.12, openssl-static-1.0.1e-30.el6_6.12
- Red Hat Enterprise Linux Server EUS (v. 6.6) openssl-1.0.1e-30.el6_6.12, openssl-1.0.1e-30.el6_6.12.ppc, openssl-devel-1.0.1e-30.el6_6.12 +1
- Red Hat Enterprise Linux Server EUS (v. 7.1) openssl-1:1.0.1e-42.ael7b_1.10, openssl-1:1.0.1e-42.el7_1.10, openssl-devel-1:1.0.1e-42.ael7b_1.10 +5
- Red Hat Enterprise Linux Server Optional EUS (v. 6.6) openssl-perl-1.0.1e-30.el6_6.12, openssl-static-1.0.1e-30.el6_6.12
- Red Hat Enterprise Linux Server Optional EUS (v. 7.1) openssl-perl-1:1.0.1e-42.ael7b_1.10, openssl-perl-1:1.0.1e-42.el7_1.10, openssl-static-1:1.0.1e-42.ael7b_1.10 +2
Fixes 2 records
Priority HIGH 67
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, wh…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.82112 · Published 2016-03-01 · Partial fix CWE-200
Priority LOW 39
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by perfor…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.10731 · Published 2016-02-15 · Partial fix CWE-200
