Red Hat Security Advisory

RHSA-2020:1840

openssl security and bug fix update

Released 2020-04-28 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1c-15.el8, openssl-devel-1:1.1.1c-15.el8, openssl-libs-1:1.1.1c-15.el8 +1

Fixes 3 records

TI-2019-01187 CVE-2019-1549 · GHSA-xmjp-8ccm-cf6h

Fork Protection

LOW 33

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06182 Published 2019-09-10 Partial fix CWE-330

TI-2019-01191 CVE-2019-1563 · GHSA-rv3r-f48w-6vvh

Padding Oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey

LOW 30

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transp…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.03838 Published 2019-09-10 Partial fix CWE-203

TI-2019-01186 CVE-2019-1547 · GHSA-q2qv-648h-wcqp

ECDSA remote timing attack

LOW 24

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths.

CVSS 3.1MEDIUM 4.7 Local Low privileges No interaction EPSS 0.01129 Published 2019-09-10 Partial fix