Scientific Linux SL5.x SL6.x SLSA-2014:0627-1 Important Openssl Update

Date: Wed, 11 Jun 2014 15:32:51 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Important: openssl on SL5.x, SL6.x i386/x86_64
MIME-Version: 1.0

Synopsis: Important: openssl security update
Advisory ID: SLSA-2014:0627-1
Issue Date: 2014-06-05
CVE Numbers: CVE-2014-0224
--

It was found that OpenSSL clients and servers could be forced, via a
specially crafted handshake packet, to use weak keying material for
communication. A man-in-the-middle attacker could use this flaw to decrypt
and modify traffic between a client and a server. (CVE-2014-0224)

Note: In order to exploit this flaw, both the server and the client must
be using a vulnerable version of OpenSSL; the server must be using OpenSSL
version 1.0.1 and above, and the client must be using any version of
OpenSSL. For more information about this flaw, refer to:

For the update to take effect, all services linked to the OpenSSL library
(such as httpd and other SSL-enabled services) must be restarted or the
system rebooted.
--

SL5
 x86_64
 openssl-0.9.8e-12.el5_6.12.i686.rpm
 openssl-0.9.8e-12.el5_6.12.x86_64.rpm
 openssl-debuginfo-0.9.8e-12.el5_6.12.i386.rpm
 openssl-debuginfo-0.9.8e-12.el5_6.12.i686.rpm
 openssl-debuginfo-0.9.8e-12.el5_6.12.x86_64.rpm
 openssl-devel-0.9.8e-12.el5_6.12.i386.rpm
 openssl-devel-0.9.8e-12.el5_6.12.x86_64.rpm
 openssl-perl-0.9.8e-12.el5_6.12.x86_64.rpm
 openssl-0.9.8e-26.el5_9.4.i686.rpm
 openssl-0.9.8e-26.el5_9.4.x86_64.rpm
 openssl-debuginfo-0.9.8e-26.el5_9.4.i386.rpm
 openssl-debuginfo-0.9.8e-26.el5_9.4.i686.rpm
 openssl-debuginfo-0.9.8e-26.el5_9.4.x86_64.rpm
 openssl-devel-0.9.8e-26.el5_9.4.i386.rpm
 openssl-devel-0.9.8e-26.el5_9.4.x86_64.rpm
 openssl-perl-0.9.8e-26.el5_9.4.x86_64.rpm
 i386
 openssl-0.9.8e-12.el5_6.12.i386.rpm
 openssl-0.9.8e-12.el5_6.12.i686.rpm
 openssl-debuginfo-0.9.8e-12.el5_6.12.i386.rpm
 openssl-debuginfo-0.9.8e-12.el5_6.12.i686.rpm
 openssl-devel-0.9.8e-12.el5_6.12.i386.rpm
 openssl-perl-0.9.8e-12.el5_6.12.i386.rpm
 openssl-0.9.8e-26.el5_9.4.i386.rpm
 openssl-0.9.8e-26.el5_9.4.i686.rpm
 openssl-debuginfo-0.9.8e-26.el5_9.4.i386.rpm
 openssl-debuginfo-0.9.8e-26.el5_9.4.i686.rpm
 openssl-devel-0.9.8e-26.el5_9.4.i386.rpm
 openssl-perl-0.9.8e-26.el5_9.4.i386.rpm
SL6
 x86_64
 openssl-1.0.0-25.el6_3.3.i686.rpm
 openssl-1.0.0-25.el6_3.3.x86_64.rpm
 openssl-debuginfo-1.0.0-25.el6_3.3.i686.rpm
 openssl-debuginfo-1.0.0-25.el6_3.3.x86_64.rpm
 openssl-1.0.0-27.el6_4.4.i686.rpm
 openssl-1.0.0-27.el6_4.4.x86_64.rpm
 openssl-debuginfo-1.0.0-27.el6_4.4.i686.rpm
 openssl-debuginfo-1.0.0-27.el6_4.4.x86_64.rpm
 openssl-devel-1.0.0-25.el6_3.3.i686.rpm
 openssl-devel-1.0.0-25.el6_3.3.x86_64.rpm
 openssl-perl-1.0.0-25.el6_3.3.x86_64.rpm
 openssl-static-1.0.0-25.el6_3.3.x86_64.rpm
 openssl-devel-1.0.0-27.el6_4.4.i686.rpm
 openssl-devel-1.0.0-27.el6_4.4.x86_64.rpm
 openssl-perl-1.0.0-27.el6_4.4.x86_64.rpm
 openssl-static-1.0.0-27.el6_4.4.x86_64.rpm
 i386
 openssl-1.0.0-25.el6_3.3.i686.rpm
 openssl-debuginfo-1.0.0-25.el6_3.3.i686.rpm
 openssl-devel-1.0.0-25.el6_3.3.i686.rpm
 openssl-1.0.0-27.el6_4.4.i686.rpm
 openssl-debuginfo-1.0.0-27.el6_4.4.i686.rpm
 openssl-devel-1.0.0-27.el6_4.4.i686.rpm
 openssl-perl-1.0.0-25.el6_3.3.i686.rpm
 openssl-static-1.0.0-25.el6_3.3.i686.rpm
 openssl-perl-1.0.0-27.el6_4.4.i686.rpm
 openssl-static-1.0.0-27.el6_4.4.i686.rpm

- Scientific Linux Development Team