[slackware-security]  mod_ssl RSA blinding fixes (SSA:2003-141-05)

An upgrade for mod_ssl to version 2.8.14_1.3.27 is now available.
This version provides RSA blinding by default which prevents an
extended timing analysis from revealing details of the secret key
to an attacker.  Note that this problem was already fixed within
OpenSSL, so this is a "double fix".  With this package, mod_ssl
is secured even if OpenSSL is not.

We recommend sites using mod_ssl upgrade to this new package.


Here are the details from the Slackware 9.0 ChangeLog:
+--------------------------+
Tue May 20 20:13:09 PDT 2003
patches/packages/mod_ssl-2.8.14_1.3.27-i386-1.tgz:  Upgraded to
  mod_ssl-2.8.14_1.3.27.  Includes RSA blinding fixes.
  (* Security fix *)
+--------------------------+



WHERE TO FIND THE NEW PACKAGES:
+-----------------------------+

Updated package for Slackware 9.0: 
 



MD5 SIGNATURES:
+-------------+

Slackware 9.0 package:
2888ecec5e2116be81b5295fc477869b  mod_ssl-2.8.14_1.3.27-i386-1.tgz



INSTALLATION INSTRUCTIONS:
+------------------------+

First, shut down your web server:
# apachectl stop

Then upgrade using upgradepkg (as root):
upgradepkg mod_ssl-2.8.14_1.3.27-i386-1.tgz

Finally, restart secure web services:
# apachectl startssl



+-----+

Slackware Linux Security Team 
slackware
security@slackware.com

Slackware: mod_ssl timing based attack vulnerability

May 22, 2003
This version provides RSA blinding by default which prevents an extended timing analysis from revealing details of the secret key to an attacker.

Summary

Here are the details from the Slackware 9.0 ChangeLog: Tue May 20 20:13:09 PDT 2003 patches/packages/mod_ssl-2.8.14_1.3.27-i386-1.tgz: Upgraded to mod_ssl-2.8.14_1.3.27. Includes RSA blinding fixes. (* Security fix *) WHERE TO FIND THE NEW PACKAGES: Updated package for Slackware 9.0: MD5 SIGNATURES: Slackware 9.0 package: 2888ecec5e2116be81b5295fc477869b mod_ssl-2.8.14_1.3.27-i386-1.tgz INSTALLATION INSTRUCTIONS: First, shut down your web server: # apachectl stop Then upgrade using upgradepkg (as root): upgradepkg mod_ssl-2.8.14_1.3.27-i386-1.tgz Finally, restart secure web services: # apachectl startssl Slackware Linux Security Team slackware security@slackware.com

Where Find New Packages

MD5 Signatures

Severity
[slackware-security] mod_ssl RSA blinding fixes (SSA:2003-141-05)
An upgrade for mod_ssl to version 2.8.14_1.3.27 is now available. This version provides RSA blinding by default which prevents an extended timing analysis from revealing details of the secret key to an attacker. Note that this problem was already fixed within OpenSSL, so this is a "double fix". With this package, mod_ssl is secured even if OpenSSL is not.
We recommend sites using mod_ssl upgrade to this new package.

Installation Instructions

Related News

19.Laptop Bed Esm H320
2 - 3 min read
The release of Google Chrome 124 addresses four vulnerabilities, including a critical security flaw that can enable attackers to execute arbitrary
23.Tablet Connections Esm H320
2 - 3 min read
The release of Ubuntu 24.04 LTS , also known as Noble Numbat, brings various security enhancements and exciting new features . These improvements
4.Lock AbstractDigital Esm H320
2 - 3 min read
Tails 6.2 is a new Linux distribution release that expands its multilingual support and improves security features. The distribution is a
19.Laptop Bed Esm H320
2 - 3 min read
AlmaLinux 9.4 beta has been released and provides compelling reasons to consider it for desktop usage. While AlmaLinux is primarily known as a
32.Lock Code Circular Esm H320
2 - 3 min read
Linux admins and security practitioners face significant challenges in keeping their Linux systems secure amidst the constant threat of kernel bugs.
1.Penguin Landscape Esm H320
2 - 3 min read
A significant security threat, known as the Spectre v2 exploit, has been observed targeting Linux systems running on modern Intel processors. Let's
10.FingerPrint Locks Esm H320
2 - 3 min read
The recent release of I2P 2.5.0 , an anonymous P2P network that protects against online censorship, surveillance, and monitoring, has brought a slew
24.Key Code Esm H320
2 - 3 min read
The Akira ransomware group has extorted approximately $42 million from over 250 victims since January 1, 2024. The group initially focused on
Sign Up

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved