Red Hat Security Advisory

RHSA-2018:0998

openssl security and bug fix update

Released 2018-04-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.2k-12.el7, openssl-libs-1:1.0.2k-12.el7
Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.2k-12.el7, openssl-perl-1:1.0.2k-12.el7, openssl-static-1:1.0.2k-12.el7
Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.2k-12.el7, openssl-libs-1:1.0.2k-12.el7
Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.2k-12.el7, openssl-perl-1:1.0.2k-12.el7, openssl-static-1:1.0.2k-12.el7
Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.2k-12.el7, openssl-devel-1:1.0.2k-12.el7, openssl-devel-1:1.0.2k-12.el7.ppc +2
Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.2k-12.el7, openssl-static-1:1.0.2k-12.el7, openssl-static-1:1.0.2k-12.el7.ppc
Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.2k-12.el7, openssl-devel-1:1.0.2k-12.el7, openssl-libs-1:1.0.2k-12.el7
Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.2k-12.el7, openssl-static-1:1.0.2k-12.el7
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) openssl-1:1.0.2k-12.el7, openssl-devel-1:1.0.2k-12.el7, openssl-libs-1:1.0.2k-12.el7
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) openssl-perl-1:1.0.2k-12.el7, openssl-static-1:1.0.2k-12.el7

TI-2017-02853 CVE-2017-3737 · GHSA-fwxf-w2h7-9w25

HIGH 66

OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.78675 Published 2017-12-07 Partial fix CWE-125

TI-2017-02854 CVE-2017-3738 · GHSA-gj3m-w8pf-46c5

MEDIUM 41

There is an overflow bug in the AVX2 Montgomery multiplication procedure used in exponentiation with 1024-bit moduli.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.13411 Published 2017-12-07 Partial fix CWE-200

TI-2017-02852 CVE-2017-3736 · GHSA-72w7-9ghx-p5pg

MEDIUM 41

There is a carry propagating bug in the x86_64 Montgomery squaring procedure in OpenSSL before 1.0.2m and 1.1.0 before 1.1.0g.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.10133 Published 2017-11-02 Partial fix CWE-200