Moderate CentOS openssl Update

Metadata

medium
unknown
openssl-0.9.8e-22.el5_8.4.i386.rpm, openssl-0.9.8e-22.el5_8.4.i686.rpm, openssl-0.9.8e-22.el5_8.4.src.rpm, openssl-0.9.8e-22.el5_8.4.x86_64.rpm, openssl-1.0.0-20.el6_2.5.i686.rpm, openssl-1.0.0-20.el6_2.5.src.rpm, openssl-1.0.0-20.el6_2.5.x86_64.rpm, openssl-devel-0.9.8e-22.el5_8.4.i386.rpm, openssl-devel-0.9.8e-22.el5_8.4.x86_64.rpm, openssl-devel-1.0.0-20.el6_2.5.i686.rpm, openssl-devel-1.0.0-20.el6_2.5.x86_64.rpm, openssl-perl-0.9.8e-22.el5_8.4.i386.rpm, openssl-perl-0.9.8e-22.el5_8.4.x86_64.rpm, openssl-perl-1.0.0-20.el6_2.5.i686.rpm, openssl-perl-1.0.0-20.el6_2.5.x86_64.rpm, openssl-static-1.0.0-20.el6_2.5.i686.rpm, openssl-static-1.0.0-20.el6_2.5.x86_64.rpm
rhn.redhat.com, lists.centos.org, lists.centos.org
2012-05-29
2017-07-27 20:03
2017-07-27 19:03
2017-04-01 19:05
2017-01-05 20:09

Description


Updated openssl packages that fix one security issue and one bug are now
available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL v2/v3)
and Transport Layer Security (TLS v1) protocols, as well as a
full-strength, general purpose cryptography library.

An integer underflow flaw, leading to a buffer over-read, was found in the
way OpenSSL handled DTLS (Datagram Transport Layer Security) application
data record lengths when using a block cipher in CBC (cipher-block
chaining) mode. A malicious DTLS client or server could use this flaw to
crash its DTLS connection peer. (CVE-2012-2333)

Red Hat would like to thank the OpenSSL project for reporting this issue.
Upstream acknowledges Codenomicon as the original reporter.

On Red Hat Enterprise Linux 6, this update also fixes an uninitialized
variable use bug, introduced by the fix for CVE-2012-0884 (released via
RHSA-2012:0426). This bug could possibly cause an attempt to create an
encrypted message in the CMS (Cryptographic Message Syntax) format to fail.

All OpenSSL users should upgrade to these updated packages, which contain a
backported patch to resolve these issues. For the update to take effect,
all services linked to the OpenSSL library must be restarted, or the system
rebooted.
Please see https://www.redhat.com/footer/terms-of-use.html

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Release Package Patched in
5 openssl openssl-0.9.8e-22.el5_8.4.i386.rpm
openssl openssl-0.9.8e-22.el5_8.4.i686.rpm
openssl openssl-0.9.8e-22.el5_8.4.src.rpm
openssl openssl-0.9.8e-22.el5_8.4.x86_64.rpm
openssl-devel openssl-devel-0.9.8e-22.el5_8.4.i386.rpm
openssl-devel openssl-devel-0.9.8e-22.el5_8.4.x86_64.rpm
openssl-perl openssl-perl-0.9.8e-22.el5_8.4.i386.rpm
openssl-perl openssl-perl-0.9.8e-22.el5_8.4.x86_64.rpm
6 openssl openssl-1.0.0-20.el6_2.5.i686.rpm
openssl openssl-1.0.0-20.el6_2.5.src.rpm
openssl openssl-1.0.0-20.el6_2.5.x86_64.rpm
openssl-devel openssl-devel-1.0.0-20.el6_2.5.i686.rpm
openssl-devel openssl-devel-1.0.0-20.el6_2.5.x86_64.rpm
openssl-perl openssl-perl-1.0.0-20.el6_2.5.i686.rpm
openssl-perl openssl-perl-1.0.0-20.el6_2.5.x86_64.rpm
openssl-static openssl-static-1.0.0-20.el6_2.5.i686.rpm
openssl-static openssl-static-1.0.0-20.el6_2.5.x86_64.rpm