Red Hat Security AdvisoryRHSA-2016:0372
openssl098e security update
Released 2016-03-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl098e-0.9.8e-29.el7_2.3
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl098e-0.9.8e-29.el7_2.3
- Red Hat Enterprise Linux Desktop (v. 6) openssl098e-0.9.8e-20.el6_7.1
- Red Hat Enterprise Linux HPC Node (v. 6) openssl098e-0.9.8e-20.el6_7.1
- Red Hat Enterprise Linux Server (v. 6) openssl098e-0.9.8e-20.el6_7.1, openssl098e-0.9.8e-20.el6_7.1.ppc
- Red Hat Enterprise Linux Server (v. 7) openssl098e-0.9.8e-29.el7_2.3, openssl098e-0.9.8e-29.el7_2.3.ppc
- Red Hat Enterprise Linux Workstation (v. 6) openssl098e-0.9.8e-20.el6_7.1
- Red Hat Enterprise Linux Workstation (v. 7) openssl098e-0.9.8e-29.el7_2.3
Fixes 5 records
Priority HIGH 67
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, wh…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.82112 · Published 2016-03-01 · Partial fix CWE-200
Priority MEDIUM 42
The SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a allows remote attackers to cause a denial of service (s2_lib.c assertion failure and daemon exit) via…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.21247 · Published 2015-03-19 · Partial fix CWE-20
Priority LOW 39
ssl/s2_srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by perfor…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.10731 · Published 2016-02-15 · Partial fix CWE-200
Priority LOW 36
An oracle protection mechanism in the get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a overwrites incorr…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.06903 · Published 2016-03-02 · Partial fix CWE-200
Priority LOW 35
The get_client_master_key function in s2_srvr.c in the SSLv2 implementation in OpenSSL before 0.9.8zf, 1.0.0 before 1.0.0r, 1.0.1 before 1.0.1m, and 1.0.2 before 1.0.2a accepts a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGT…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.05398 · Published 2016-03-02 · Partial fix CWE-200
THREATIST.IORead the docs