Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Fedora 21: 2015-10108 Important OpenSSL Security Patch For Moderate Issues

fedora
Calendar Grey June 24, 2015
Dist Fedora Esm H88
The latest Fedora 21 OpenSSL patch addresses multiple moderate and minor security vulnerabilities, enhancing the safety of interactions.
Multiple moderate and low impact security issues fixed.

Summary

The OpenSSL toolkit provides support for secure communications between

machines. OpenSSL includes a certificate management tool and shared

libraries which provide various cryptographic algorithms and

protocols.

Update Information:

Multiple moderate and low impact security issues fixed.

Topics%20covered

Topics Covered

security advisory update Fedora moderate impact security patch openssl protocols

Change Log

* Mon Jun 15 2015 Tomáš Mráz 1.0.1k-10 - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent - fix CVE-2015-1791 - race condition handling NewSessionTicket - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function - add missing parts of CVE-2015-0209 fix for corectness although unexploitable * Fri May 29 2015 Tomáš Mráz 1.0.1k-9 - fix CVE-2015-4000 - prevent the logjam attack on client - restrict the DH key size to at least 768 bits (limit will be increased in future) * Thu Apr 30 2015 Tomáš Mráz 1.0.1k-8 - try to find alternative cert chains (#1166614) * Thu Apr 9 2015 Tomáš Mráz 1.0.1k-7 - drop the AES-GCM restriction of 2^32 operations because the IV is always 96 bits (32 bit fixed field + 64 bit invocation field) * Thu Mar 19 2015 Tomáš Mráz 1.0.1k-6 - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey() - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data - fix CVE-2015-0293 - triggerable assert in SSLv2 server * Mon Mar 16 2015 Tomáš Mráz 1.0.1k-5 - fix bug in the CRYPTO_128_unwrap() * Fri Feb 27 2015 Tomáš Mráz 1.0.1k-4 - fix bug in the RFC 5649 support (#1185878) * Sat Feb 21 2015 Till Maas - 1:1.0.1k-3 - Rebuilt for Fedora 23 Change https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code * Thu Jan 15 2015 Tomáš Mráz 1.0.1k-2 - test in the non-FIPS RSA keygen for minimal distance of p and q similarly to the FIPS RSA keygen * Fri Jan 9 2015 Tomáš Mráz 1.0.1k-1 - new upstream release fixing multiple security issues * Tue Oct 21 2014 Tomáš Mráz 1.0.1j-2 - update the FIPS RSA keygen to be FIPS 186-4 compliant

References


[ 1 ] Bug #1228603 - CVE-2015-1789 OpenSSL: out-of-bounds read in X509_cmp_time https://bugzilla.redhat.com/show_bug.cgi?id=1228603 [ 2 ] Bug #1228604 - CVE-2015-1790 OpenSSL: PKCS7 crash with missing EnvelopedContent https://bugzilla.redhat.com/show_bug.cgi?id=1228604 [ 3 ] Bug #1228607 - CVE-2015-1792 OpenSSL: CMS verify infinite loop with unknown hash function https://bugzilla.redhat.com/show_bug.cgi?id=1228607 [ 4 ] Bug #1228608 - CVE-2015-1791 OpenSSL: Race condition handling NewSessionTicket https://bugzilla.redhat.com/show_bug.cgi?id=1228608

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update openssl' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
important
Lowest
Low
Medium
High
Critical

Name: openssl
Product: Fedora 21
Version: 1.0.1k
Release: 10.fc21
URL: https://www.openssl.org:443/
Summary: Utilities from the general purpose cryptography library with TLS implementation

Topics%20covered

Topics Covered

security advisory update Fedora moderate impact security patch openssl protocols

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here