TI-2018-00682 CVE-2018-0734 · GHSA-93g8-hm6f-hrw3
Timing attack against DSA
Priority MEDIUM 46
The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack.
RHSA-2019:2304
openssl security and bug fix update
Released 2019-08-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) openssl-1:1.0.2k-19.el7, openssl-libs-1:1.0.2k-19.el7
- Red Hat Enterprise Linux Client Optional (v. 7) openssl-devel-1:1.0.2k-19.el7, openssl-perl-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) openssl-1:1.0.2k-19.el7, openssl-libs-1:1.0.2k-19.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) openssl-devel-1:1.0.2k-19.el7, openssl-perl-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7
- Red Hat Enterprise Linux Server (v. 7) openssl-1:1.0.2k-19.el7, openssl-devel-1:1.0.2k-19.el7, openssl-devel-1:1.0.2k-19.el7.ppc +2
- Red Hat Enterprise Linux Server Optional (v. 7) openssl-perl-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7.ppc
- Red Hat Enterprise Linux Workstation (v. 7) openssl-1:1.0.2k-19.el7, openssl-devel-1:1.0.2k-19.el7, openssl-libs-1:1.0.2k-19.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) openssl-perl-1:1.0.2k-19.el7, openssl-static-1:1.0.2k-19.el7
Fixes 2 records
TI-2019-01190 CVE-2019-1559 · GHSA-9ccq-7hvh-cv7p
0-byte record padding oracle
Priority MEDIUM 43
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte r…